1. An end-user device, comprising: one or more modems for enabling the wireless end-user device to communicate over at least a first wireless access network; memory configured to store a first application program configured to execute on the wireless end-user device and further configured to assist the end-user device in accessing one or more data services over at least the first wireless access network, a first application credential associated with the first application program, a first policy comprising one or more first policy instructions to be applied when the first application program initiates or attempts to initiate a communication over the first wireless access network; and one or more device agents configured to detect an attempted installation of update software on the end-user device, the update software purporting to be a modification, update, or replacement of the first application program, obtain an update-software credential associated with the update software, obtain the first application credential, allow the update software to be installed on the wireless end-user device if the update-software credential matches the first application credential, determine when the first application program initiates or attempts to initiate a communication over the first wireless access network, and apply the first policy when the first application program initiates or attempts to initiate a communication over the first wireless access network.