Newbie question about Kerberos

[Paul Silverman]

When the TGS issues a ticket to a user to access an application which
accepts Kerberos as an authentication protocol, what is precisely the
process to ensure that the ticket is valid and therefore access can be
granted ?

Does the Kerberized app forward the ticket to the authentification
service of the KDC in order to make sure that the ticket is indeed
valid ?  Or does it check with its own local directory ?

Thanks.

Paul