A method, implemented by one or more computing devices, for managing behavior of at least one application, comprising: receiving sensed information that represents a plurality of features in an environment; associating the sensed information with one or more final policies, to provide final policy information, the final policy information pertaining to at least one object in the environment and being specified, at least in part, by the environment; identifying permissions which apply to one or more applications, based on the final policy information, to collectively provide permission information; and governing behavior of said one or more applications based on the permission information, said identifying of permissions being configured to set different types of permissions for different types of policies, including an out-of-band final policy and/or an in-band final policy, characterised by: the out-of-band final policy governing a behavior of at least one application, based on the permissions that have been identified, upon encountering a Quick Response, QR, code associated with said at least one final policy, up until an explicit mode-changing event occurs, said at least one final policy remaining in place between the encountering of the QR code and the mode-changing event even without the QR code being actively present within the sensed information, and the in-band final policy governing a behavior of at least one application based on the permissions that have been identified and remaining in place, only so long as a QR code associated with said at least one final policy is detected within the environment by a recognition system and is actively present within the sensed information. receiving sensed information that represents a plurality of features in an environment; associating the sensed information with one or more final policies, to provide final policy information, the final policy information pertaining to at least one object in the environment and being specified, at least in part, by the environment; identifying permissions which apply to one or more applications, based on the final policy information, to collectively provide permission information; and governing behavior of said one or more applications based on the permission information, said identifying of permissions being configured to set different types of permissions for different types of policies, including an out-of-band final policy and/or an in-band final policy, characterised by: the out-of-band final policy governing a behavior of at least one application, based on the permissions that have been identified, upon encountering a Quick Response, QR, code associated with said at least one final policy, up until an explicit mode-changing event occurs, said at least one final policy remaining in place between the encountering of the QR code and the mode-changing event even without the QR code being actively present within the sensed information, and the in-band final policy governing a behavior of at least one application based on the permissions that have been identified and remaining in place, only so long as a QR code associated with said at least one final policy is detected within the environment by a recognition system and is actively present within the sensed information. the out-of-band final policy governing a behavior of at least one application, based on the permissions that have been identified, upon encountering a Quick Response, QR, code associated with said at least one final policy, up until an explicit mode-changing event occurs, said at least one final policy remaining in place between the encountering of the QR code and the mode-changing event even without the QR code being actively present within the sensed information, and the in-band final policy governing a behavior of at least one application based on the permissions that have been identified and remaining in place, only so long as a QR code associated with said at least one final policy is detected within the environment by a recognition system and is actively present within the sensed information.