1. Computer apparatus for enforcing control policies of a rights-management system with respect to a target application, comprising: a computer having: a rules-based engine member for coupling between the rights-management system and one or more target applications, the rules-based engine member centralizing data security determinations for the target applications; and one or more agents coupled between the rules-based engine member and the target applications, the agents monitoring program operations of respective target applications as low-level program events in the respective target applications, and providing indications of respective monitored low-level program events to the rules-based engine member, wherein the rules-based engine member: i) in response to the indications provided by the agents, identifies specific patterns in sequences of low-level program events that signify actions by respective target applications and its users managed by the control policies of the rights-management system and updates states of respective target applications, wherein said identified specific patterns include specific patterns in sequences of low-level program events that signify a user's attempt to exercise a control policy right and ii) in response to requests of actions made by the agents, given the updated states of respective target applications, makes determinations to direct enforcement of the control policies through the agents; and wherein the rules-based engine member employs (i) a generic engine framework, (ii) a rules engine, (iii) a working memory storing assertions of the target applications as supplied by the agents, and (iv) a knowledge base holding sets of rules, and the sets of rules encode the control policies of the rights-management system as generic program events and application-level abstractions.