A system that controls access to a communications network in accordance with a network service includes a service controller and a network connector. The service controller receives a request for the network service from an end system, provides the end system with a unique setup identifier and an enabling certificate, and instructs the end system to send a connection setup request to access the communications network, the connection setup request including the certificate and the unique setup identifier. The certificate includes information relating to a permitted setup and service policy or logic representing service capabilities or service permissions. The network connector receives the connection setup request from the end system, processes the connection setup request based on the certificate and the unique identifier, and establishes a network connection in accordance with at least the certificate.