A method implemented on a UE includes determining an application class of an application, and permitting or barring access by the application to a communication network according to a comparison of the determined application with a rule to provide application class based access control. The application is classified into the determined application class. The application is classified into the determined application class by a home network. The application is classified into the determined application class by a 3GPP layer. The application is classified into the determined application class by a visited network. The visited network classifies the application into a further application class. The rule includes a list of applications for permitting or barring access by the applications according to the comparison of the determined application class with the rule.