User authentication and authorization system for a mobile application

A system for enforcing a security policy on an application stored at a mobile device has an application at the device provided with software code for issuing a request for authenticating a user, and a security enforcement unit; an authentication agent at the device, which is separate from the application, and which is configured with an authentication data collecting unit for collecting authentication data upon receipt of the request for user authentication from the application, and for conveying the collected authentication data to an authentication-authorization server; and an authentication-authorization server for receiving the collected authentication data, evaluating the same, and issuing an enforcement level signal which is conveyed to the security enforcement unit. Upon receipt of the enforcement level signal, the security enforcement unit accordingly applies a security level at the application.