A mechanism for dynamically constructing service implementations to enforce restrictions on services provided to an application is disclosed. When an application desires an implementation for a particular service, the application makes a request to a framework. The framework receives the request and, in response, determines what restrictions, if any, need to be imposed on the requested implementation. Once the restrictions are determined, the framework dynamically constructs the requested implementation. The requested implementation is constructed such that it incorporates a general implementation of the service, the restrictions, and enforcement logic for enforcing the restrictions on the general implementation. Once the requested implementation is constructed, it is provided to the application. Thereafter, the application invokes the requested implementation directly for services. Since the requested implementation incorporates the restrictions and enforcement logic for enforcing the restrictions, it is not necessary for the application to further interact with the framework. The requested implementation itself will provide the services, and will guarantee that the restrictions are enforced. By dynamically constructing requested implementations in this manner, the framework ensures that the necessary restrictions are enforced on the services provided to the application.