A mobile device comprising: a cellular network modem capable of data communication over different carrier access networks; and a memory capable of storing pre-activation credentials and permanent credentials; wherein the mobile device is configured to use stored pre-activation credentials and a pre-activation service policy in an ambient access mode, wherein in the ambient access mode the mobile device is configured to provide network access control according to the pre-activation service policy to allow and block access to a first carrier access network via the cellular network modem, and wherein an allowed network service activity is an activation sequence comprising: connecting the device to an Internet-connected activation server through the first carrier access network, providing cellular network service options from the activation server to a user of the device, including cellular network service options corresponding to different service providers, accepting input from the user to select a first one of the cellular network service options for a selected one of the different service providers, forwarding, based on the input, an activation request for the first service option to the activation server, and receiving from the activation server a set of permanent credentials corresponding to the selected service option and selected service provider and storing the permanent credentials in the memory so that the permanent credentials supersede the pre-activation credentials. a cellular network modem capable of data communication over different carrier access networks; and a memory capable of storing pre-activation credentials and permanent credentials; wherein the mobile device is configured to use stored pre-activation credentials and a pre-activation service policy in an ambient access mode, wherein in the ambient access mode the mobile device is configured to provide network access control according to the pre-activation service policy to allow and block access to a first carrier access network via the cellular network modem, and wherein an allowed network service activity is an activation sequence comprising: connecting the device to an Internet-connected activation server through the first carrier access network, providing cellular network service options from the activation server to a user of the device, including cellular network service options corresponding to different service providers, accepting input from the user to select a first one of the cellular network service options for a selected one of the different service providers, forwarding, based on the input, an activation request for the first service option to the activation server, and receiving from the activation server a set of permanent credentials corresponding to the selected service option and selected service provider and storing the permanent credentials in the memory so that the permanent credentials supersede the pre-activation credentials. connecting the device to an Internet-connected activation server through the first carrier access network, providing cellular network service options from the activation server to a user of the device, including cellular network service options corresponding to different service providers, accepting input from the user to select a first one of the cellular network service options for a selected one of the different service providers, forwarding, based on the input, an activation request for the first service option to the activation server, and receiving from the activation server a set of permanent credentials corresponding to the selected service option and selected service provider and storing the permanent credentials in the memory so that the permanent credentials supersede the pre-activation credentials.