A method comprising: loading, by a computing device (103, 201), application code of a mobile application; modifying, by the computing device (103, 201), the application code to wrap the application with an application wrapper that is configured to manage execution of the application based on one or more policy files and configured to intercept one or more functions of the application code, wherein the one or more policy files each define one or more access controls that are enforced by a device management system on one or more user devices; creating, by the computing device (103, 201), a library file comprising field-programmable business logic defining implementation code linked to one or more of the functions intercepted by the wrapper; providing, by the computing device (103, 201), the wrapped application and the library file to at least one user device; after providing the wrapped application and the library file to the at least one user device, creating, by the computing device (103, 201), an updated library file, wherein the updated library file comprises updated field-programmable business logic defining updated implementation code linked to functions intercepted by the wrapper; after creating, by the computing device (103, 201), an updated library file, providing, by the computing device (103, 201), the updated library file to the at least one user device; and after providing, by the computing device (103, 201), the updated library file, re-wrapping, by the computing device (103, 201), the wrapped application, and providing, by the computing device (103, 201), the re-wrapped application to the at least one user device. loading, by a computing device (103, 201), application code of a mobile application; modifying, by the computing device (103, 201), the application code to wrap the application with an application wrapper that is configured to manage execution of the application based on one or more policy files and configured to intercept one or more functions of the application code, wherein the one or more policy files each define one or more access controls that are enforced by a device management system on one or more user devices; creating, by the computing device (103, 201), a library file comprising field-programmable business logic defining implementation code linked to one or more of the functions intercepted by the wrapper; providing, by the computing device (103, 201), the wrapped application and the library file to at least one user device; after providing the wrapped application and the library file to the at least one user device, creating, by the computing device (103, 201), an updated library file, wherein the updated library file comprises updated field-programmable business logic defining updated implementation code linked to functions intercepted by the wrapper; after creating, by the computing device (103, 201), an updated library file, providing, by the computing device (103, 201), the updated library file to the at least one user device; and after providing, by the computing device (103, 201), the updated library file, re-wrapping, by the computing device (103, 201), the wrapped application, and providing, by the computing device (103, 201), the re-wrapped application to the at least one user device.