1. Admin selects "Enable mobile" feature in Advanced features. Moodle displays a javascript alert or mentions in the information text than the Moodle web service feature and the xml-rpc server/protocol will be automatically enabled.

2. Moodle checks that no "Moodle mobile" service was already created ("Moodle mobile" service id will be saved in config_plugin table). Moodle creates automatically a none built-in "Moodle mobile" service including all web service functions.
This kind of service is editable. The service will be created enabled for all users by default. Only people having the createtoken capability can generate a token anyway. Please check that the mobile entry point script generating the token does check this capability!

3. The admin uncheck "Enable mobile" => the service is disabled.

Other solution:
---------------
We could create a disabled built-in service by default during Moodle install/upgrade. This would be the logical way to do. However the problem being that these built-in services have been designed "not editable" to restrict the admin to make any errors. It implies that at the moment creating built-in service does not allow the admin to restrict the mobile functionalities.

To think of:

• save the service id in config table in a generic way so other local plugin can created their own service for their own app. Key => external_service_id_of_xxxx / xxxx => moodle_mobile_service.
• the upgrade script should clean up the mdl_external_function_service table. We could have in services.php some sort of definition of service/function mapping for service created on the fly:

$onflycreatedservice = 

    array(

        'moodle_mobile_service' => array('moodle_webservice_mobile_get_siteinfo', 'moodle_course_create_courses')

    )