questions related to API access control

Hi everybody,

My name is Nenad Milidrag and I am working for the company that provides Mobile Device Management (MDM) solutions.  We are investigating if we can provide MDM service for devices that are running AGL.

I have been reading about building the application for the AGL that can access certain APIs.  After a few days of research, I have exhausted most resources I have found and still have very wage clue about API access control.  I guess the question is how Cynara gets configured?  I am assuming that when one writes the config.xml for the wgt package he will specify all required and optional APIs.  Then when the application is installed using afm-util, the installer will be prompted with the question if access to the API should be allowed or declined.  Installers' feedback will then be saved into the Cynara configuration.  Is this correct? 

Further, some documents are talking about signing the application and then some are talking about different tiers of the users but more in the context of proposals and without details on how it will be used.  Is there a document that provides details on these two topics?

I am apologizing for the long email.

Thank you for your insight.

Regards,

Nenad