1. A computer-implemented method comprising: monitoring, by a client agent, information content on a client for violations of a policy; determining, by the client agent, that a violation of the policy has occurred for content of a temporary file of an application, wherein the temporary file reflects an edited state of a corresponding original application file of the application; correlating, by the client agent, the policy violation of the temporary file with the original application file of the application; and reporting the policy violation with a name of the original application file, wherein correlating further comprises: monitoring file system operations for the temporary file; detecting that a first file system operation has occurred; detecting that a second file system operation has occurred subsequent to the first file system operation; and correlating the policy violation of the temporary file with the name of the original application file in response to detection of a sequence of the first and second file system operations.