In one example, a method includes receiving, with a network device, a portion of a subscriber session packet flow for a subscriber session, and reassembling application-layer data from data packets in the subscriber session packet flow into one or more application flows for the subscriber session. The method includes identifying, from the application flows, application identity information for the application flows, and applying a first session policy to the subscriber session. Applying the first session policy includes applying one or more application policies to the application flows in the subscriber session based on subscriber information and the application identity information for the application flows. The method includes processing the application flows in the subscriber session for accessing a packet data network in accordance with the application policies.