Resources to a device are granted access to an application based on privileges associated with the application. A permission list may be created by a server. The permission list may be created using information from authorities, entities, or parties and information about the device resources. The permission list indicates what device resources the application may access. During application execution when the application requests a resource, a control program executing on the device may be used to check the permission list associated with the application to determine if the application may access the resource. The control program can then grant or deny access based on the privileges defined in the permission list. Digital signatures may be used to detect modifications to the application and/or permission list. In addition, multiple permission lists may be associated with the same application.