1. A method comprising: providing an application firewall deployed at a gateway and in communication with an endpoint through a network, the application firewall configured to provide conditional, rule-based access to network resources by an application executing on the endpoint; labeling data on the endpoint as secure data for type-dependent processing; monitoring the application executing on the endpoint; on the endpoint, coloring the application in response to a first observed action that includes an exposure to out-of-network data with a descriptor of a context for the first observed action, the descriptor including one or more attributes selected for a relevance to threat detection; applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a transmission, from the endpoint, of the data labeled as secure data; communicating the reportable event through the network from the endpoint to the application firewall; and limiting access by the application through the gateway to a network resource with the application firewall based on the reportable event.