1. A method performed by a computer, the method comprising: intercepting or redirecting a call to an operating system made via a function invoked by a software application in order to perform the function for a secure document, wherein the function is separate from the operating system, and wherein the function comprises an operation to be performed for the secure document; determining one or more security policies for the secure document, wherein the one or more security policies are specific to the secure document, and wherein the one or more security policies restrict operation of one or more functions for the secure document; determining, dependent on the one or more security policies, whether the operation of the function is restricted for the secure document; in response to determining that the operation of the function is restricted for the secure document, executing a modified, patched version of the function, wherein the modified, patched version of the function is separate from the operating system and comprises patch code combined with the original function by insertion into the original function, and wherein the inserted patch code restricts the operation of the function for the secure document according to the one or more security policies; wherein said executing the modified, patched version of the function accesses a version of the secure document in compliance with the restricted operation of the function for the secure document.