Not necessarily, in selinux for example you would configure a domain for the "main process" which can transition into a lower permission domain for "app" code.