1. A method for information management comprising: monitoring output from an application to an operating system, wherein the output is monitored substantially continuously; determining if a policy applies to data associated with the output; and executing the policy if the policy applies.