1. A method comprising: providing an interceptor code component and a policy engine code component executing on a client, wherein the interceptor code component resides within an operating system layer executing on the client, and the policy engine code component is outside of the operating system layer; allowing an application program on the client to access a first document stored on a server, wherein a document access operation is initiated by the application program and detected by the interceptor code component, and the interceptor code component transfers handling of the document access operation to the policy engine code component; after the allowing the access to the first document stored on the server, intercepting by the interceptor code component a request by the application program to perform an operation on the accessed first document, wherein the request comprises a command to execute application code of the application program and the application code corresponds to executing one or more operating system library commands; before allowing the request, receiving an intended action data associated with the request made to the application program; if the intended action data associated with the request is not prohibited by policies, allowing the request by allowing a first operating system library command; disallowing by the interceptor code component the first operating system library command of the one or more operating system library commands from executing; evaluating the application program operation on the client comprising: detecting whether a policy enforcer program is at the client; if not detected, denying the request; and if detected, communicating with the client comprising requesting policy information from the policy engine code component of the client; and confirming the client has an ability to interact with the server comprising: evaluating the policy information to determine whether policies at the client will be capable of controlling a second document when the polices are enforced by the policy enforcer program, wherein the second document is to be stored at the client after the request to perform the operation is permitted and comprises a content of the first document; if the policies are determined to be capable, permitting the request; if the policies are determined to be capable, permitting the first operating system library command of the one or more operating system library commands to execute; and if the polices are determined to be incapable, denying the request.