A system for securely providing Information to, and adapted for being used together with, an end-user device adapted for obtaining the information from the system over a secure service control link on a wireless access network, the system comprising: a communications interface; and one or more network elements (1638, 5618, 1652, 5402, 1621), further characterized in that the communications interface enables a service control Server link element in the system to communicate with a service control device link agent on the end-user device over the secure service control link, the secure service control link established by executing a link-agent authorization procedure and secured by an encryption protocol and providing for control-plane communications between the system and the end-user device, the encryption protocol using an encryption key shared by the service control device link agent and the service control server link element, and the one or more network elements are configured to: provide information associated with one or more pre-packaged service-control options to the service control device link agent over the secure service control link, each of the one or more pre-packaged service-control options corresponding to an access-network control policy configured to govern a particular service activity of a plurality of service activities available to the end-user device, obtain a user preference from the service control device link agent over the secure service control link, the user preference indicating a particular service-control option of the one or more pre-packaged service-control options, and assist in provisioning one or more network traffic-control elements to enforce a particular access-network control policy corresponding to the particular service-control option. a communications interface; and one or more network elements (1638, 5618, 1652, 5402, 1621), further characterized in that the communications interface enables a service control Server link element in the system to communicate with a service control device link agent on the end-user device over the secure service control link, the secure service control link established by executing a link-agent authorization procedure and secured by an encryption protocol and providing for control-plane communications between the system and the end-user device, the encryption protocol using an encryption key shared by the service control device link agent and the service control server link element, and the one or more network elements are configured to: provide information associated with one or more pre-packaged service-control options to the service control device link agent over the secure service control link, each of the one or more pre-packaged service-control options corresponding to an access-network control policy configured to govern a particular service activity of a plurality of service activities available to the end-user device, obtain a user preference from the service control device link agent over the secure service control link, the user preference indicating a particular service-control option of the one or more pre-packaged service-control options, and assist in provisioning one or more network traffic-control elements to enforce a particular access-network control policy corresponding to the particular service-control option. provide information associated with one or more pre-packaged service-control options to the service control device link agent over the secure service control link, each of the one or more pre-packaged service-control options corresponding to an access-network control policy configured to govern a particular service activity of a plurality of service activities available to the end-user device, obtain a user preference from the service control device link agent over the secure service control link, the user preference indicating a particular service-control option of the one or more pre-packaged service-control options, and assist in provisioning one or more network traffic-control elements to enforce a particular access-network control policy corresponding to the particular service-control option.