1. A method comprising: providing a system comprising unencrypted and encrypted document content, wherein an unencrypted document is encrypted to become an encrypted document, and the encrypted document is larger in size than the unencrypted document from which it is derived; providing a policy server accessible to devices of the system, wherein the policy server comprises a plurality of policies and each policy manages access to documents of the system; providing an encryption service driver executing on a computing device of the devices of the system, wherein the policy server is separate from the computing device; permitting access to an encrypted document by an application program on the computing device; when an access to the encrypted document occurs, using the encryption service to intercept the access of the encrypted document, wherein the intercepting the access of the encrypted document occurs at a system level of the application program comprising: allowing the access to the encrypted document by the application program to execute until a first system level operation executes; identifying the first system level operation as executing due to the application program requesting access to the encrypted document; preventing the first system level operation from executing; at the encryption service, identifying the application program attempting to access the encrypted document; from the encryption service, sending identification information on the application program to a policy enforcer component, executing on the computing device; controlling access to the unencrypted content based on the first policy comprising: identifying a first application process identifier assigned by an operating system executing on the computing device for the application program, wherein the application program is attempting access to the encrypted document; receiving a decryption key based on the first application process identifier at the encryption service; using the encryption service to decrypt the encrypted document to produce the unencrypted content; providing the unencrypted content to the application program; and allowing the first system level operation to execute.
2. The method of claim 1 comprising: if the application program is determined not to be trusted, providing encrypted content of the encrypted document to the application program.