They can be set by services just like modes, but ultimately it's the ircd that handles them. Any action taken on a user or channel can only be requested by services, it's up to the ircd to take action since that is where the user is connected.
For future inquiries, remember that:
IRCds prevent users from doing things and is first to know.
Services reacts to users doing things and is last to know.
Hope that helps.