An electronic device comprising: a storage medium configured to: store a software module for execution on the electronic device; and store at least one profile comprising at least one entitlement associated with the software module; and means for receiving, by a kernel executing in a trusted space of an operating system executing on the processor, a request to execute the software module stored on the electronic device, the software module created by a developer trusted to test software on the electronic device; means for communicating, by the kernel, data indicative of the software module to a policy service executing as a trusted process in an untrusted space of the operating system executing on the processor, the data indicative of the software module comprising at least one entitlement requested for executing the software module, and the policy service having been verified trusted upon execution; means for obtaining, by the policy service, a digest generated from at least one portion of executable instructions for the software module, the digest signed by the developer; means for identifying, by the policy service, one or more profiles for the developer associated with the software module, the one or more profiles created and signed by a trusted authority and comprising data indicative of the at least one entitlement permitted for executing software created by the developer; means for authenticating, by the policy service, the at least one requested entitlement based at least in part on verifying the at least one requested entitlement against the at least one permitted entitlement in the one or more identified profiles and verifying the digest; means for communicating, by the policy service, the at least one requested entitlement to the kernel; and means for executing the software module on the processor based on the at least one requested entitlement. a storage medium configured to: store a software module for execution on the electronic device; and store at least one profile comprising at least one entitlement associated with the software module; and store a software module for execution on the electronic device; and store at least one profile comprising at least one entitlement associated with the software module; and means for receiving, by a kernel executing in a trusted space of an operating system executing on the processor, a request to execute the software module stored on the electronic device, the software module created by a developer trusted to test software on the electronic device; means for communicating, by the kernel, data indicative of the software module to a policy service executing as a trusted process in an untrusted space of the operating system executing on the processor, the data indicative of the software module comprising at least one entitlement requested for executing the software module, and the policy service having been verified trusted upon execution; means for obtaining, by the policy service, a digest generated from at least one portion of executable instructions for the software module, the digest signed by the developer; means for identifying, by the policy service, one or more profiles for the developer associated with the software module, the one or more profiles created and signed by a trusted authority and comprising data indicative of the at least one entitlement permitted for executing software created by the developer; means for authenticating, by the policy service, the at least one requested entitlement based at least in part on verifying the at least one requested entitlement against the at least one permitted entitlement in the one or more identified profiles and verifying the digest; means for communicating, by the policy service, the at least one requested entitlement to the kernel; and means for executing the software module on the processor based on the at least one requested entitlement.