Some embodiments include an internet service provider (ISP) system capable of delegating network policy configuration tasks to ISP franchisee accounts. For example, the ISP system can establish, via a backhaul channel, a network tunnel from an access point hosting a local area network (LAN) to a gateway server connected to a wide area network (WAN). The ISP system can authenticate an ISP franchisee account operating a mobile device. The ISP franchisee account can configure, from the mobile device, a network usage policy associated with using the network tunnel, the gateway server, and/or application services available through the gateway server. The ISP system can authenticate a subscriber account operating a subscriber device to connect with the WAN from the LAN. The ISP system can enforce, at the gateway server, the network usage policy when the customer device is using the access point to access the WAN through the gateway server.