Abstract: A method for verifying an application structured to execute on a client device. A challenge request is sent to the application. A candidate challenge answer is received from the application in response to the challenge request, which is then provided as input to a verification computation with a challenge input. Based on an output of the verification computation, it is determined that the candidate challenge answer is generated by providing the challenge input to a challenge computation. Based on the determination that the candidate challenge answer is generated by providing the challenge input to the challenge computation, the application is verified.

Abstract: A “hybrid” policy execution mechanism is provided herein. A hybrid policy execution server uses initial context data received from a client device is to partially execute a ‘full’ policy, resulting in a (simplified) local policy that can be implemented at the client device. The local policy indicates an action and associated local condition that can be evaluated locally at the client device, enabling the client device to determine whether to perform the action in response to a first trigger event without a further call to the hybrid policy execution server. In certain embodiments, the local policy may indicate a call-back condition, which triggers a call-back to the hybrid policy execution server in response to a second trigger event, e.g. with additional context that is now available to the client device. The call-back mechanism can incorporate richer policy conditions that are evaluated server-side.