The growth of the applications and services market for mobile devices is currently slowed down by the lack of a flexible and reliable security infrastructure. The develop- ment and adoption of a new generation of mobile appli- cations depends on the end user's ability to finely manage system security and control application's behavior. The vir- tual execution environment for mobile software and services should support the security needs of users and applications. This paper proposes an extension to the security architec- ture of the Java Virtual Machine for mobile systems, to sup- port fine-grained policy specification and run-time enforce- ment. Access control decisions are based on system state, application and system history data, as well as request spe- cific parameters. The prototype implementation is running on desktops, as emulator, and on mobile devices, proving the high level of flexibility and security, with excellent per- formance provided by the extended architecture.