An apparatus, comprising: an loT support service (351; 451), including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, causes the IoT support service (351; 451) to perform actions, including: storing a plurality of module twins (421,422,423) that respectively correspond to a plurality of modules (431,432,433) of an edge application on an edge device (311, 312, 341, 342, 343; 411), wherein the plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules (431, 432, 433), and wherein the plurality of modules (431, 432, 433) are compositable together into the edge application, and the modules of the plurality of modules (431, 432, 433) are capable of being used interoperably with other modules without altering the other modules; enabling communications between the modules of the plurality of modules (431, 432, 433) and the loT support service (351; 451) according to a common security context; determining at least one module of the plurality of modules (431, 432, 433) to be modified by adding a declarative rule, such that the declarative rule causes determining whether an event has been triggered, and, in response to the triggering of the event, communicating the triggering of the event to at least one declarative target; and causing the determined at least one module of the plurality of modules (431, 432, 433) to be modified by adding the declarative rule. storing a plurality of module twins (421,422,423) that respectively correspond to a plurality of modules (431,432,433) of an edge application on an edge device (311, 312, 341, 342, 343; 411), wherein the plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules (431, 432, 433), and wherein the plurality of modules (431, 432, 433) are compositable together into the edge application, and the modules of the plurality of modules (431, 432, 433) are capable of being used interoperably with other modules without altering the other modules; wherein the plurality of module twins individually include metadata associated with the corresponding module of the plurality of modules (431, 432, 433), and wherein the plurality of modules (431, 432, 433) are compositable together into the edge application, and the modules of the plurality of modules (431, 432, 433) are capable of being used interoperably with other modules without altering the other modules; enabling communications between the modules of the plurality of modules (431, 432, 433) and the loT support service (351; 451) according to a common security context; determining at least one module of the plurality of modules (431, 432, 433) to be modified by adding a declarative rule, such that the declarative rule causes determining whether an event has been triggered, and, in response to the triggering of the event, communicating the triggering of the event to at least one declarative target; and causing the determined at least one module of the plurality of modules (431, 432, 433) to be modified by adding the declarative rule.