The short answer is that the ROUTER/GATEWAY can detect if the user is authenticated or not, based on the list of allowed clients sent back from the AAA service (server or service).
Most small WiFi setup's usually use a built in functionality on their router, which has a direct callback to the AAA service, so that once the user signs up, the router is almost instantly updated, and the user is given access.
The process works pretty much the same on major networks; with the exception that the AAA service is usually a RADIUS or other type of major AAA server, which authorizes, and updates all associated MESH AP's with the user information, so that they have direct access to the net (and not using the captive DNS settings).
In both cases above, the gateway/router is usually the first to detect if the user is authenticated, using either MAC routing tables, or callbacks to the authenticated AAA services tied directly into the router.
On major networks, the Gateway (the first major server that the user interacts with, can accomplish this job; but normally, the first line of defense is the AP, which can detect if the user is allowed on the network, and re-route if not to the AAA service.
Hope that made a bit more sense.