1. A method for limiting access to an electronic document, comprising: associating, by one or more computing devices, a classifier with a first state of a process-driven security policy having a plurality of states, with different states having different sets of access restrictions; associating, by the one or more computing devices, an identifier representing a user or a group of users with the first state of the process-driven security policy; associating, by the one or more computing devices, the electronic document with at least the first state of the process-driven security policy having a set of access restrictions on the electronic document; limiting access to the electronic document by encrypting, by the one or more computing devices, at least a portion of the electronic document using a group key corresponding to the identifier and a state key corresponding to the classifier and requiring at least both the group key and the state key to decrypt at least the portion of the electronic document; and changing, by the one or more computing devices, the state of the process-driven security policy for the electronic document automatically without user or administrator interaction from the first state to a second state in response to an internal or external system event, wherein the changed state is based on a transition rule associated with the event.