Essentially, you are talking about authorization (as opposed to authentication). You authenticate your clients when they login, then you authorize them when they attempt to use a given method. On each method you will need to check that users permissions to see if they are authorized to use that method. If they are not, return a 401. If they are, allow the method to execute. In your case, this check will include checking if they are licensed for that method.
How you accomplish this will depend on the details of your application. There are dozens of good ways to do it. I don't think there is any across the board standard for this.