1. An end-user device, comprising: one or more modems for enabling the end-user device to communicate over at least a first wireless access network; memory configured to store: a first application program configured to execute on the end-user device and further configured to assist the end-user device in accessing one or more data services over at least the first wireless access network, a first application credential associated with the first application program, a first policy comprising one or more first policy instructions to be applied when the first application program initiates or attempts to initiate communication over the first wireless access network; and one or more device agents configured to: detect an attempted installation of update software on the end-user device, the update software purporting to be a modification, update, or replacement of the first application program, obtain an update-software credential associated with the update software, obtain the first application credential, determine whether the update-software credential matches the first application credential, when the update-software credential matches the first application credential, allow the update software to be installed on the end-user device, determine that the first application program is initiating or attempting to initiate communication over the first wireless access network, and based on the determination that the first application program is initiating or attempting to initiate communication over the first wireless access network, apply the first policy.