1. A method comprising: performing operations as follows on a processor of a mobile device: responsive to occurrence of a defined event associated with an application package, fetching a policy definition library from a policy server through a data network, the policy definition library containing policies defining resources of the mobile device that the application package is permitted to access; executing the wrapped application package containing application executable code and application wrapper executable code that is called by each execution of an agnostic wrapper function residing at each of a plurality of locations in the application executable code; and responsive to execution of the agnostic wrapper function at any of the plurality of locations in the application executable code, executing the application wrapper executable code to control whether access by the application executable code is granted to resources of the mobile device based on the policies contained in the policy definition library.