On a basic level its a "container" that uses selinux to create a separate security space in which "work" apps and data live, so they they don't mingle with your personal apps. The Android for Work administrator has complete control over that part of the phone, but can't touch any personal apps or data. There are also updated email/calendar/contacts apps. This made mainly to address BYOD scenarios.