An embedded universal integrated circuit card (eUlCC) configured to control and enforce policy rules, the eUlCC comprising: a policy rule storage configured to define actions and conditions required to enforce a plurality of policies and store a plurality of policy rules including a plurality of policy rules for each profile and a plurality of policy rules for the eUlCC; a policy controller configured to control the plurality of policy rules; and a policy enforcer configured to enforce the plurality of policy rules, wherein the policy rules for each profile and the policy rules for the eUlCC comprise a file structure having one or more of a type of policy rule, a variable representing the type of the policy rule, and a location in which the policy rule is located, wherein the policy enforcer is configured to evaluate conditions of the policy rules and configured to determine execution of a command based on the evaluation, wherein the policy rules for each profile and the policy rules for the eUlCC being managed in physically different files, wherein, when a change from a first mobile network operator to a second MNO is attempted, the policy controller is configured to perform: setting a profile of the second MNO for a loadable profile ID through a policy rule for the eUlCC; identifying a lock status of the eUlCC based on a first policy rule, the first policy rule being included in the policy rules for the eUICC; in response to identifying that the lock status of the eUlCC is locked, identifying effective period information of the lock status of the eUlCC based on a second policy rule, the second policy rule being included in the policy rules for the eUICC; and rejecting a subscription change for the second MNO, based on the lock status of the eUlCC and the effective period information of the lock status of the eUICC, wherein the plurality of policy rules for each profile comprise a policy rule associated with a profile which is enabled in the eUlCC, and wherein the policy controller and the policy enforcer use credentials for security conditions, the credentials including a profile access credential, a profile installer credential, and a profile management credential. a policy rule storage configured to define actions and conditions required to enforce a plurality of policies and store a plurality of policy rules including a plurality of policy rules for each profile and a plurality of policy rules for the eUlCC; a policy controller configured to control the plurality of policy rules; and a policy enforcer configured to enforce the plurality of policy rules, wherein the policy rules for each profile and the policy rules for the eUlCC comprise a file structure having one or more of a type of policy rule, a variable representing the type of the policy rule, and a location in which the policy rule is located, wherein the policy enforcer is configured to evaluate conditions of the policy rules and configured to determine execution of a command based on the evaluation, wherein the policy rules for each profile and the policy rules for the eUlCC being managed in physically different files, wherein, when a change from a first mobile network operator to a second MNO is attempted, the policy controller is configured to perform: setting a profile of the second MNO for a loadable profile ID through a policy rule for the eUlCC; identifying a lock status of the eUlCC based on a first policy rule, the first policy rule being included in the policy rules for the eUICC; in response to identifying that the lock status of the eUlCC is locked, identifying effective period information of the lock status of the eUlCC based on a second policy rule, the second policy rule being included in the policy rules for the eUICC; and rejecting a subscription change for the second MNO, based on the lock status of the eUlCC and the effective period information of the lock status of the eUICC, wherein the plurality of policy rules for each profile comprise a policy rule associated with a profile which is enabled in the eUlCC, and wherein the policy controller and the policy enforcer use credentials for security conditions, the credentials including a profile access credential, a profile installer credential, and a profile management credential. setting a profile of the second MNO for a loadable profile ID through a policy rule for the eUlCC; identifying a lock status of the eUlCC based on a first policy rule, the first policy rule being included in the policy rules for the eUICC; in response to identifying that the lock status of the eUlCC is locked, identifying effective period information of the lock status of the eUlCC based on a second policy rule, the second policy rule being included in the policy rules for the eUICC; and rejecting a subscription change for the second MNO, based on the lock status of the eUlCC and the effective period information of the lock status of the eUICC, wherein the plurality of policy rules for each profile comprise a policy rule associated with a profile which is enabled in the eUlCC, and wherein the policy controller and the policy enforcer use credentials for security conditions, the credentials including a profile access credential, a profile installer credential, and a profile management credential.