A method comprising: receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system (300, 400) on the client device, wherein each of the one or more policy instructions defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system (300, 400); obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application; receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application; receiving, by the controller service from a second application, a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; determining, by the controller service, the first application identifier from the received information identifying the first application; obtaining, by the controller service, a second application identifier associated with the second application; and associating, by the controller service, the first application identifier with the second application identifier. receiving, by a controller service from a client device, a request to associate a first application executing on the client device with the controller service, the controller service being configured to control the first application via one or more policy instructions located on the client device and enforced by a mobility management system (300, 400) on the client device, wherein each of the one or more policy instructions defines one or more restrictions enforced on or one or more enablements granted to the first application by the mobility management system (300, 400); obtaining, by the controller service, a first application identifier associated with the first application, the first application identifier corresponding to a first set of the one or more policy instructions used to control the first application; receiving, by the controller service from an application service, a request for a first service and a conditional application identifier; responsive to the conditional application identifier matching the first application identifier, configuring, by the controller service and based on the request for the first service, the first application with a second set of one or more policy instructions used to control the first application; receiving, by the controller service from a second application, a request to associate the second application executing on the client device with the controller service and information identifying the first application that is different than the first application identifier; determining, by the controller service, the first application identifier from the received information identifying the first application; obtaining, by the controller service, a second application identifier associated with the second application; and associating, by the controller service, the first application identifier with the second application identifier.