A method, apparatus and computer program product provide an application server implementing configurable security models. An example of the method includes receiving a first access request from a first client application, determining a first client identifier for the first client application based at least in part on the first access request, using the first client identifier to identify one or more first security models associated with the first client application from a database, the database comprising a plurality of client identifiers and a plurality of indications of security models associated with each of the plurality of client identifiers, executing an application instance providing functionality in accordance with the one or more first security models, and processing the first access request using the application instance.