1. A method for enforcing a network policy on an application executing within a first context, the method comprising: intercepting, by an agent executing in the first context, a network socket event request from the application before the network socket event request reaches a transport layer in a network stack of the first context; sending, by the agent to a security server executing in a second context, a request for a decision on whether to allow or deny the intercepted network socket event, the request for the decision including an application identifier; receiving, by the agent, the decision from the security server, the decision being an allowance or a denial of the network socket event request, the decision being based at least in part on the indication of the identity of the application and a network policy; and preventing, by the agent, the network socket request from reaching the transport layer in the first context when the decision is the denial of the network socket event request.