1. A method for controlling activity in an application process comprising: running an agent process as an autonomous process that is separate from the application process, the agent process further performing the steps of: detecting a set of predetermined low-level events related to operation of the application process by a user; identifying at least one application profile that represents a correspondence of a set of detected low-level user events to an application-level activity associated with the application process; and controlling further permitted application-level activities, according to one or more rules associated with the application profile that corresponded to the detected set of low-level events, without modifying program logic of the application process.