1. A network system for providing connection to one or more Internet data services for one or more wireless end-user devices communicatively coupled to the network system over a wireless access network, the network system comprising: a policy enforcement function configured to block or forward Internet data traffic for each of the wireless end-user devices according to a respectively applicable data access policy for each such wireless end-user device, the respectively applicable data access policy for a first one of the wireless end-user devices initially comprising a first data access policy that allows Internet data traffic forwarding for the first one of the end-user devices for the limited purpose of communication between a service processor executing on the first one of the end-user devices and a service controller reachable through the policy enforcement function; and a first policy element configured to, upon receiving a first indication from the service controller that the first one of the wireless end-user devices has at least one active Internet data service plan allowing access to an Internet data service, and that the service processor can be trusted to enforce and account for Internet data service supplied to that device according to the at least one active Internet data service plan, instruct the policy enforcement function to apply a second data access policy to Internet data traffic for the first one of the wireless end-user devices, the second data access policy allowing forwarding of Internet data traffic between the first one of the wireless end-user devices and unspecified Internet destinations.