1. A computer-implemented method, comprising: receiving, at an application programming interface of a computing resource service provider, a request from a customer of the computing resource service provider to associate a measurement of executable instructions of an application operating within an enclave with an application identity of the application, wherein the application identity specifies a version for the application; registering the measurement in association with the application identity in a data store of a policy enforcement service; receiving, at a service of the computing resource service provider, a request from a version of an installed application to access a resource in an environment of the computing resource service provider, the request specifying the application identity and a credential; authenticating the version of the installed application by determining that the received application identity matches a registered application identity and verifying that the credential is a measurement of executable instructions of the installed application that matches the measurement of executable instructions of the application; and allowing the version of the installed application to access the resource.