1. A method of operating a wireless end-user device, the method comprising: storing secure policy information indicative of an application-specific execution environment policy and a configurable communication security policy; based on the secure stored information indicative of an application-specific execution environment policy, allowing a first set of multiple device application instances to run only in a first secure application environment on the wireless end-user device, and allowing a second set of device application instances to run only outside of the first secure application environment; and based on the secure stored information indicative of a configurable communication security policy, initiate a first secure tunnel to a network tunnel endpoint, and direct all network data communications to and from device application instances executing in the first secure application environment through the first secure tunnel.