In a system comprising a device comprising a plurality of domains (221, 222, 223, 224, 225, 226) supported by at least one platform, each domain of the plurality of domains comprising a configuration of computing resources executing on the at least one platform and each domain of the plurality of domains being configured to perform functions for an owner of the domain that may be located locally or remotely from the domain, wherein the plurality of domains comprises a remote owner domain owned by a remote owner (224, 225, 226) and a user domain owned by a user of the device, the remote owner domain and the user domain being isolated from each other, a method comprising: registering the user with the remote owner as a subscribed user of a subscription-based service to be rendered by the remote owner through the remote owner domain (224, 225, 226) of the device, the remote owner domain having resources such that access to the resources of the remote owner domain is limited to entities authorized by the remote owner; and obtaining credentials, by the remote owner domain of the device, from the remote owner that enable the user to use the subscription-based service as the subscribed user; storing the credentials in the remote owner domain of the device (224, 225, 226); and receiving, by the user domain that is isolated from the remote owner domain of the device, an acknowledgement from the remote owner domain that the credentials have been received by the remote owner domain, the user domain having resources such that access to the resources of the user domain is limited to entities authorized by the user, wherein obtaining credentials from the remote owner further comprises sending, by the user domain, a credential roll-out request to the remote owner domain, the credential roll-out request including information that identifies at least one of the user or a third party that facilitates sale of the subscription-based service of the user. registering the user with the remote owner as a subscribed user of a subscription-based service to be rendered by the remote owner through the remote owner domain (224, 225, 226) of the device, the remote owner domain having resources such that access to the resources of the remote owner domain is limited to entities authorized by the remote owner; and obtaining credentials, by the remote owner domain of the device, from the remote owner that enable the user to use the subscription-based service as the subscribed user; storing the credentials in the remote owner domain of the device (224, 225, 226); and receiving, by the user domain that is isolated from the remote owner domain of the device, an acknowledgement from the remote owner domain that the credentials have been received by the remote owner domain, the user domain having resources such that access to the resources of the user domain is limited to entities authorized by the user, wherein obtaining credentials from the remote owner further comprises sending, by the user domain, a credential roll-out request to the remote owner domain, the credential roll-out request including information that identifies at least one of the user or a third party that facilitates sale of the subscription-based service of the user.