A network system for providing notification messages to one or more agents (1691, 1694, 1695, 1697, 1692, 1696, 1693, 1690) on an end-user device, the network system comprising: a communication interface for enabling the network system to communicate with the end-user device over a wireless access network; one or more network elements configured to assist in establishing a secure service control link between the network system and one or more agents on the end-user device, the secure service control link secured by an encryption protocol and configured to support control plane communications between the end-user device and the network system, execute an authorization process to enable secure service control link communications with the one or more agents, the authorization process comprising sharing a device credential, and based on the shared device credential, identifying the one or more agents as a recipient of a notification message, thereby authorizing the one or more agents to communicate with the network system, characterized in that the one or more network elements are further configured to monitor access-network traffic associated with one or more services run by the end-user device, based on the monitored access-network traffic, determine when a notification trigger criterion associated with at least one of the services has been satisfied, and based on the notification trigger criterion being satisfied, send the notification message to the one or more agents over the secure service control link, the notification message for assisting the one or more agents in causing a notification content to be presented through a user interface of the end-user device. a communication interface for enabling the network system to communicate with the end-user device over a wireless access network; one or more network elements configured to assist in establishing a secure service control link between the network system and one or more agents on the end-user device, the secure service control link secured by an encryption protocol and configured to support control plane communications between the end-user device and the network system, execute an authorization process to enable secure service control link communications with the one or more agents, the authorization process comprising sharing a device credential, and based on the shared device credential, identifying the one or more agents as a recipient of a notification message, thereby authorizing the one or more agents to communicate with the network system, characterized in that the one or more network elements are further configured to monitor access-network traffic associated with one or more services run by the end-user device, based on the monitored access-network traffic, determine when a notification trigger criterion associated with at least one of the services has been satisfied, and based on the notification trigger criterion being satisfied, send the notification message to the one or more agents over the secure service control link, the notification message for assisting the one or more agents in causing a notification content to be presented through a user interface of the end-user device.