1. A method to be executed by a processor, comprising: intercepting a host content change request indicating a change to a persistent object on a host computer; determining whether the change is authorized, as indicated by a set of change authorization policies; allowing the change to take effect when the change is authorized; blocking the change from taking effect when the change is not authorized; logging information about the host content change request; obtaining a log representing a set of host content change requests; comparing the log to a set of approved change orders for any one or more of a plurality of persistent objects on the host computer; identifying at least one correlation between the set of host content change requests and the set of approved change orders; and providing user-readable data representing the at least one correlation, wherein the set of change authorization policies is configurable to define whether the persistent object can be changed.