1. A method comprising: receiving, by a security module operating on a network device, from an application source, data for an application including a first set of application permissions describing elements of the network device to which the application will have access upon installation of the application; determining, by the network device, a type for the application; storing, by the network device, the received data for the application in a region of a storage medium of the network device; receiving, by the network device, from a management console, a second set of permissions including at least one of allowable permissions representing permissions allowed for the type for the application or disallowable permissions representing permissions that are not allowed for the type for the application; based on a comparison of the first set of application permissions and the second set of permissions, by the network device, allowing the application to execute or preventing the application from executing.