A method for managing operations on a client by an activation manager on a backend server, the method comprising: receiving, by the activation manager, a request from an application service provider, ASP, for performing an operation on the client, wherein the requested operation is a device management operation selected from a group consisting of: deploying an application, personalizing/configuring an application, updating an application, uninstalling an application, and deploying a security patch on the client; determining, by the activation manager, whether the requested operation is not pre-approved and so requires user approval; based on the determination that the requested operation is not pre-approved and so requires user approval: generating, by the activation manager, an extended authorization token comprising a user constraint which includes a user approval method, wherein the user constraint signals to the client that the user approval method is required before the requested operation may be carried out on the client; transmitting the extended authorization token from the activation manager to the client; displaying, by the client, the user approval method; receiving, by the client, a user response to the user approval method; and executing by the client, the requested operation on the client, either when the received user response indicates approval of the requested operation or when the requested operation is pre-approved. receiving, by the activation manager, a request from an application service provider, ASP, for performing an operation on the client, wherein the requested operation is a device management operation selected from a group consisting of: deploying an application, personalizing/configuring an application, updating an application, uninstalling an application, and deploying a security patch on the client; determining, by the activation manager, whether the requested operation is not pre-approved and so requires user approval; based on the determination that the requested operation is not pre-approved and so requires user approval: generating, by the activation manager, an extended authorization token comprising a user constraint which includes a user approval method, wherein the user constraint signals to the client that the user approval method is required before the requested operation may be carried out on the client; transmitting the extended authorization token from the activation manager to the client; displaying, by the client, the user approval method; generating, by the activation manager, an extended authorization token comprising a user constraint which includes a user approval method, wherein the user constraint signals to the client that the user approval method is required before the requested operation may be carried out on the client; transmitting the extended authorization token from the activation manager to the client; displaying, by the client, the user approval method; receiving, by the client, a user response to the user approval method; and executing by the client, the requested operation on the client, either when the received user response indicates approval of the requested operation or when the requested operation is pre-approved.