They give clients "permission" to access servers. If a client accesses a server and there's no CAL for that client, you're in violation of your licensing agreement. They're kept on paper basically.