A wireless end-user device, comprising: a wireless wide area network (WWAN) modem to receive and transmit data between the device and at least one WWAN (136, 138) when configured for and connected to the at least one WWAN (136, 138); and one or more processors configured to execute one or more processes in a kernel execution partition (112, 212, 312, 412, 612, 712), one or more processes in an application execution partition (102, 202, 302, 402, 702), and one or more processes in a protected execution partition (114, 214, 314, 414, 614, 714, 814, 914, 1114), the one or more processes executed in the kernel execution partition (112, 212, 312, 412, 612, 712) including an operating system packet network stack to pass data traffic between the WWAN modem and one or more applications (106A, 106B, 106C) executing in the application execution partition (102, 202, 302, 402, 702), an application identification agent (420, 620, 720) to classify individual flows of the data traffic passing through the stack according to which of the one or more applications (106A, 106B, 106C) is associated with a particular individual flow, a service measurement agent to measure, for classified individual flows, an amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C), and a policy control agent to apply application-specific traffic policy controls to classified individual flows, the one or more processes executed in the protected execution partition (114, 214, 314, 414, 614, 714, 814, 914, 1114) including one or more device agents with limited privileges to access processes executing in the kernel execution partition (112, 212, 312, 412, 612, 712), including a privilege to configure the application-specific traffic policy controls of the policy control agent, and a privilege to receive at least one of data traffic passing between the operating system packet network stack and the WWAN modem, and information including the measured amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C). a wireless wide area network (WWAN) modem to receive and transmit data between the device and at least one WWAN (136, 138) when configured for and connected to the at least one WWAN (136, 138); and one or more processors configured to execute one or more processes in a kernel execution partition (112, 212, 312, 412, 612, 712), one or more processes in an application execution partition (102, 202, 302, 402, 702), and one or more processes in a protected execution partition (114, 214, 314, 414, 614, 714, 814, 914, 1114), the one or more processes executed in the kernel execution partition (112, 212, 312, 412, 612, 712) including an operating system packet network stack to pass data traffic between the WWAN modem and one or more applications (106A, 106B, 106C) executing in the application execution partition (102, 202, 302, 402, 702), an application identification agent (420, 620, 720) to classify individual flows of the data traffic passing through the stack according to which of the one or more applications (106A, 106B, 106C) is associated with a particular individual flow, a service measurement agent to measure, for classified individual flows, an amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C), and a policy control agent to apply application-specific traffic policy controls to classified individual flows, the one or more processes executed in the protected execution partition (114, 214, 314, 414, 614, 714, 814, 914, 1114) including one or more device agents with limited privileges to access processes executing in the kernel execution partition (112, 212, 312, 412, 612, 712), including a privilege to configure the application-specific traffic policy controls of the policy control agent, and a privilege to receive at least one of data traffic passing between the operating system packet network stack and the WWAN modem, and information including the measured amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C). the one or more processes executed in the kernel execution partition (112, 212, 312, 412, 612, 712) including an operating system packet network stack to pass data traffic between the WWAN modem and one or more applications (106A, 106B, 106C) executing in the application execution partition (102, 202, 302, 402, 702), an application identification agent (420, 620, 720) to classify individual flows of the data traffic passing through the stack according to which of the one or more applications (106A, 106B, 106C) is associated with a particular individual flow, a service measurement agent to measure, for classified individual flows, an amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C), and a policy control agent to apply application-specific traffic policy controls to classified individual flows, the one or more processes executed in the protected execution partition (114, 214, 314, 414, 614, 714, 814, 914, 1114) including one or more device agents with limited privileges to access processes executing in the kernel execution partition (112, 212, 312, 412, 612, 712), including a privilege to configure the application-specific traffic policy controls of the policy control agent, and a privilege to receive at least one of data traffic passing between the operating system packet network stack and the WWAN modem, and information including the measured amount of the data traffic associated with each of the one or more applications (106A, 106B, 106C).