Some Zephr customers elect to not use the Zephr CDN network, usually because of an incumbent CDN which is impractical to replace. In these cases, it is possible to use the Zephr Decision Engine via API.
A common practice is to call the Decision Engine in real-time, edge-side from a different CDN. Of course you can call the Zephr API from the CMS itself, although edge caching would be a potential concern for performance. The responses from the Decision API can advise the developer how to implement access control, but the actual transformation of content (or selection of variant documents) is left up to the implementation logic.
Zephr also features a collection of Public APIs, including Entitlement Challenge and Decision Engine APIs. These are designed to be called from a client (such as a Web browser) and the results implemented client-side.