Usually, when people say that they don't want TLS but something called "application-level", then the raw, naked truth is that they don't know what they are blabbering about.
Mind the "usually", though: there are situations where TLS is insufficient, and something else is needed and is to be applied at some level which can be dubbed "application". Main case is when some client has to send requests with some sort of enforceable responsibility; in short words, when requests must be signed so that, should problems occurs, the request could serve as proof during a trial. TLS does not do signatures; it uses signatures internally, but only for authentication. The client can be sure that it talks to the right server (and also vice versa, if client certificates are used), but it has no proof which could be convincing in the eyes of a judge.
Of course, people who require "ALS" but cannot give decent specifications are unlikely to be aware of such subtleties. They are probably just applying some piece of dogma that they do not understand. To counter that, do as they ask: implement some Application-Level Security which consists in exchanging "messages" as "sequences of bytes" which happen to be identical to what is described in RFC 5246.
This point has been made before, brilliantly, in an easy-to-grasp graphic format:
(I hope Scott Adams' lawyers will forgive me for quoting this remarkable piece of wisdom.)