1. At a computer system, a method for verifying at runtime that a software application initiated by a computer user is the software application expected by the computer system user, the method comprising: an act of receiving a user associated command from a user of the computer system, the user associated command for instantiating a software application previously installed at the computer system, the previous installation comprising installing an application manifest and application data objects in a shared repository and installing a user manifest in a private repository for an initial installing user; an act of verifying that a digital signature of the application manifest corresponds to a public key of a user manifest for the associated user; an act of verifying that an application identifier of the application manifest matches an application identifier of the user manifest; and an act of verifying that the application data objects belong to the software application by comparing the application data objects to one or more data object identifiers in the application manifest.