A method performed by a computer system comprising: receiving, at the computer system, an application; receiving, at the computer system, application information for the application; determining, at the computer system, an access privilege for the application based, in part, on the application information, wherein the application is to be executed within a sandbox on a client device, and the access privilege specifies sandbox-only execution, limited access execution by the application outside the sandbox, such that the application may access a specified subset of resources, data and/or peripherals outside the sandbox, or full access execution on the client device; setting, at the computer system, a digital rights management, DRM, setting for the application, wherein the DRM setting is associated with a deployment package, the digital rights management setting specifying that the application may be copied to multiple devices associated with a user account of a user accessing the application; generating, at the computer system, a plurality of deployment packages for the application, each for a different type of client device associated with the user account, using the application, the access privilege, the DRM setting and a type of the client device to which the respective deployment package is to be provided; publishing, by the computer system, the application; and providing, from the computer system, the deployment packages to different client devices associated with the user account, for allowing each client device to execute its respective deployment package using a Java Runtime Environment, JRE on the client device, wherein the DRM setting is enforced by the Java Runtime Environment. receiving, at the computer system, an application; receiving, at the computer system, application information for the application; determining, at the computer system, an access privilege for the application based, in part, on the application information, wherein the application is to be executed within a sandbox on a client device, and the access privilege specifies sandbox-only execution, limited access execution by the application outside the sandbox, such that the application may access a specified subset of resources, data and/or peripherals outside the sandbox, or full access execution on the client device; setting, at the computer system, a digital rights management, DRM, setting for the application, wherein the DRM setting is associated with a deployment package, the digital rights management setting specifying that the application may be copied to multiple devices associated with a user account of a user accessing the application; generating, at the computer system, a plurality of deployment packages for the application, each for a different type of client device associated with the user account, using the application, the access privilege, the DRM setting and a type of the client device to which the respective deployment package is to be provided; publishing, by the computer system, the application; and providing, from the computer system, the deployment packages to different client devices associated with the user account, for allowing each client device to execute its respective deployment package using a Java Runtime Environment, JRE on the client device, wherein the DRM setting is enforced by the Java Runtime Environment.