A mechanism and method for controlling the rights and/or behavior of applications in a terminal, especially in a mobile terminal, are disclosed. At least some of the messages generated by an application residing in the terminal and destined for a communication network are diverted to an independent controlling entity also residing in the terminal. In the controlling entity, the messages are controlled before being transmitted to the network. Depending on the application and its behavior in the terminal, the control entity may modify the messages or even prevent their sending to the network. The modification may include inserting control data, such as a digest, which can be used to authenticate the application.