1. A computer method for maintaining and managing control over data objects in a distributed context, said method comprising the steps of: attaching to each data object an identification of a respective control policy, wherein each control policy comprises at least (i) an indication of a set of users who may access the data object, (ii) an indication of privileges granted to each user in the set, and (iii) an indication of a set of users who may define or edit the control policy; storing the control policies (on a server); and upon a user requesting to access a data object, checking whether the user is in the set of users who may access the data object in the manner requested, based on the respective control policy of the data object.