A secure element configured to establish and enforce a security policy associated with an access control element, the secure element comprising: a memory configured to store the access control element; and a processor configured to cause the secure element to carry out steps that include: receiving a first set of credentials associated with a first logical entity; receiving a second set of credentials associated with a second logical entity; establishing, based on the first set of credentials and the second set of credentials, a security policy that includes a set of privileges, wherein each privilege in the set of privileges defines: (i) a specific logical entity selected from the first logical entity or the second logical entity, and (ii) a type of management operation directed to the access control element that the specific logical entity is authorized to request the secure element to carry out; receiving, from either the first logical entity or the second logical entity, a request to carry out a type of management operation; and carrying out or ignoring the request in accordance with the security policy. a memory configured to store the access control element; and a processor configured to cause the secure element to carry out steps that include: receiving a first set of credentials associated with a first logical entity; receiving a second set of credentials associated with a second logical entity; establishing, based on the first set of credentials and the second set of credentials, a security policy that includes a set of privileges, wherein each privilege in the set of privileges defines: (i) a specific logical entity selected from the first logical entity or the second logical entity, and (ii) a type of management operation directed to the access control element that the specific logical entity is authorized to request the secure element to carry out; receiving, from either the first logical entity or the second logical entity, a request to carry out a type of management operation; and carrying out or ignoring the request in accordance with the security policy. receiving a first set of credentials associated with a first logical entity; receiving a second set of credentials associated with a second logical entity; establishing, based on the first set of credentials and the second set of credentials, a security policy that includes a set of privileges, wherein each privilege in the set of privileges defines: (i) a specific logical entity selected from the first logical entity or the second logical entity, and (ii) a type of management operation directed to the access control element that the specific logical entity is authorized to request the secure element to carry out; (i) a specific logical entity selected from the first logical entity or the second logical entity, and (ii) a type of management operation directed to the access control element that the specific logical entity is authorized to request the secure element to carry out; receiving, from either the first logical entity or the second logical entity, a request to carry out a type of management operation; and carrying out or ignoring the request in accordance with the security policy. <EOS>