A system and method are provided for having a device in a communication system update an operational policy for the device by encoding a policy update in a virtual machine language used by a virtual machine on the device, having the policy update signed by a trusted entity, and sending a message comprising the signed policy update to the device to enable the device to implement the policy update using the virtual machine on the device. A system and method are also provided for updating an operational policy on a device in a communication system by receiving, at the device, a message comprising a signed policy update that has been signed by a trusted entity, the policy update being encoded in a virtual machine language used by a virtual machine on the device, verifying the signed policy update, and implementing the policy update using the virtual machine on the device when the policy update is verified.