1. A computer-implemented method, comprising: receiving, from a control agent installed on a mobile device, a list that includes one or more applications currently installed on the mobile device; detecting, based at least in part on the list, an installation of at least one new application on the mobile device; determining, in response to the detection of the installation of the new application, whether the new application is authorized to be installed on the mobile device based at least in part on one or more policies that indicate whether the new application is a recognized application; in the event that the installation of the new application is determined to be not authorized, adjusting a state of one or more mobile device data objects associated with the mobile device; and denying access by the mobile device to one or more network application services based at least in part on the adjusted state of the one or more mobile device data objects, wherein access is denied by blocking, at an intermediate node, traffic from the mobile device to the one or more network application services.