1. A method comprising: receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system on the client device, wherein each policy file defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system; transmitting, by the controller service to the client device, authentication information configured to be used by the first application to authenticate to a gateway device associated with the controller service; obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application; receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application; receiving, by the controller service, from a second application a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; obtaining by the controller service a second application identifier associated with the second application; and associating by the controller service the first application identifier with the second application identifier.