1. A method comprising: monitoring a document data stream for document control file identifiers; upon encountering a first control file identifier referring to a first document control file, creating a mapping of the first control file identifier to a new storage location; transforming the first control file identifier in the document data stream to a second control file identifier; referring to the new storage location based on the mapping of the first control file identifier; copying a remote document control file identified by the first control file identifier to a document control file at the new storage location specified by the mapping; protecting the document control file by one of a digital signature and other authentication mechanism; authenticating the document control file to provide a trusted copy; storing the trusted copy of the authenticated document control file at the new storage area located within a trusted repository; and processing the data stream with the second control file identifier, the processing of the data stream comprising: determining the validity of data in the document data stream using the authenticated document control file stored in the trusted repository; and halting the processing of the data stream in response to instructions included in the authenticated document control file related to processing the data stream.