A security policy execution system, which comprises: a. an application stored at a mobile device which comprises: a.1. software code within the application for issuing a request for authenticating a user; and a.2. a security enforcement unit; b. an authentication agent at said device, which is separate from the application, and which comprises an authentication data collecting unit for collecting authentication data upon receipt of said request for user authentication from the application, and for conveying said collected authentication data to an authentication-authorization server; and c. said authentication-authorization server, for receiving said collected authentication data, evaluating the same, and issuing an enforcement level signal which is conveyed to said security enforcement unit, wherein said authentication-authorization server comprises a database, wherein, upon receipt of said enforcement level signal, said security enforcement unit accordingly applies a security level at said application, characterized in that said authentication-authorization server is operable to perform a flow of conditions as follows once it receives said collected authentication data: i. inspecting data added by said application to said collected authentication data, data stored inside said database, data collected by said authentication agent, and external data provided by resources external to said authentication-authorization server; ii. if needed, issuing a request for data stored at, or which can be extracted by, said authentication agent; iii. comparing received data with data stored inside said database to reach a conclusion as to which type of action is to be taken; iv. issuing an action based on the conclusion in step iii as to which type of action is to be taken, whereby said authentication-authorization server waits for said authentication agent to execute the action and to return back as to a result of the action, calls an external system using a relevant interface to activate the action and waits for the external system to reply with a result of the action, or returns a requesting application action back to said application via said authentication agent and waits for a result of the action; v. in response to the result of the action in step iv, continuing said flow of conditions or issuing one or more additional actions; and vi. generating a token sent to said authentication agent at an end of policy flow to conclude a policy execution process, said authentication agent conveying in turn a respective enforced policy to said application. a. an application stored at a mobile device which comprises: a.1. software code within the application for issuing a request for authenticating a user; and a.2. a security enforcement unit; a.1. software code within the application for issuing a request for authenticating a user; and a.2. a security enforcement unit; b. an authentication agent at said device, which is separate from the application, and which comprises an authentication data collecting unit for collecting authentication data upon receipt of said request for user authentication from the application, and for conveying said collected authentication data to an authentication-authorization server; and c. said authentication-authorization server, for receiving said collected authentication data, evaluating the same, and issuing an enforcement level signal which is conveyed to said security enforcement unit, wherein said authentication-authorization server comprises a database, i. inspecting data added by said application to said collected authentication data, data stored inside said database, data collected by said authentication agent, and external data provided by resources external to said authentication-authorization server; ii. if needed, issuing a request for data stored at, or which can be extracted by, said authentication agent; iii. comparing received data with data stored inside said database to reach a conclusion as to which type of action is to be taken; iv. issuing an action based on the conclusion in step iii as to which type of action is to be taken, whereby said authentication-authorization server waits for said authentication agent to execute the action and to return back as to a result of the action, calls an external system using a relevant interface to activate the action and waits for the external system to reply with a result of the action, or returns a requesting application action back to said application via said authentication agent and waits for a result of the action; v. in response to the result of the action in step iv, continuing said flow of conditions or issuing one or more additional actions; and vi. generating a token sent to said authentication agent at an end of policy flow to conclude a policy execution process, said authentication agent conveying in turn a respective enforced policy to said application.