I think that an individual user would be unable to modify much in the "work" partition:

>> Control over apps in the "work" partition is handled by the end user's corporate IT team

So maybe each time the phone checks in to the network, some sort of hash is computed to see if anything is different than the expected system?