13. A method comprising: providing a policy enforcer executing at a first device; providing a first application program executing at the first device; providing a shared key ring at the first device wherein the shared key ring is associated with the policy enforcer and comprises at most one domain key and a plurality of shared keys; providing a file at the first device wherein the file further comprises a document content portion and a control data portion; extracting a content key from the control data portion; encrypting the document content portion using the content key; extracting a first key identifier from the control data portion; requesting from the policy enforcer a domain key; encrypting the control data portion of the file with the at most one domain key; at the first device, providing access to the file and its encrypted control data portion; intercepting at a second device a request to access the file at a second application program, wherein the intercepting the access of the encrypted document occurs at an system level of the application program comprising: allowing the access to the encrypted document by the application program to execute until a first system level operation executes; identifying the first system level operation as executing due to the application program requesting access to the encrypted document; and preventing the first system level operation from executing; determining at a policy enforcer executing at the second device whether the request to access the file at the second application program should be granted; and if the request to access the file at a second application program is granted, preparing the document content portion.
13. A method comprising: providing a policy enforcer executing at a first device; providing a first application program executing at the first device; providing a shared key ring at the first device wherein the shared key ring is associated with the policy enforcer and comprises at most one domain key and a plurality of shared keys; providing a file at the first device wherein the file further comprises a document content portion and a control data portion; extracting a content key from the control data portion; encrypting the document content portion using the content key; extracting a first key identifier from the control data portion; requesting from the policy enforcer a domain key; encrypting the control data portion of the file with the at most one domain key; at the first device, providing access to the file and its encrypted control data portion; intercepting at a second device a request to access the file at a second application program, wherein the intercepting the access of the encrypted document occurs at an system level of the application program comprising: allowing the access to the encrypted document by the application program to execute until a first system level operation executes; identifying the first system level operation as executing due to the application program requesting access to the encrypted document; and preventing the first system level operation from executing; determining at a policy enforcer executing at the second device whether the request to access the file at the second application program should be granted; and if the request to access the file at a second application program is granted, preparing the document content portion. 19. The method of claim 13 wherein accessing the encrypted document comprises at least one of opening the encrypted document or reading a content of the encrypted document.