A method implemented in a computing device, the method comprising: identifying an entity-trusted application on the computing device, the entity-trusted application configured to access data, and the entity-trusted application being an enlightened application; associating a first process that is a running instance of the entity-trusted application with an identifier of an entity that sets a data protection policy controlling access to the data; and enforcing, by an operating system of the computing device, the data protection policy of the entity to enhance data security provided by the computing device due to the operating system enforcing the data protection policy on behalf of the entity-trusted application, wherein enforcing the data protection policy includes enforcing the data protection policy in response to a request from the first process for the operating system to treat the enlightened application as an unenlightened application, wherein the enlightened application can switch between operating in an enlightened mode and an unenlightened mode and this switch is performed by the process that is a running instance of the enlightened application requesting that the operating system treat the enlightened application as an unenlightened application, wherein in the enlightened mode, the operating system allows the process that is a running instance of the enlightened application to protect the data in accordance with the data protection policy, and in the unenlightened mode, the operating system performs encryption and decryption, and otherwise operates to maintain the protection on the data in accordance with the data protection policy, and the operating system performs these operations on behalf of the process that is a running instance of the enlightened application as if the enlightened application were an unenlightened application, and the enforcing including: obtaining, by the operating system, the data protection policy; automatically encrypting, by the operating system in accordance with the data protection policy, data saved by the first process; saving the encrypted data in a container file that includes both metadata and the encrypted data, the metadata including the identifier of the entity; and preventing, by the operating system in accordance with the data protection policy, a second process that is a running instance of an entity-untrusted application from accessing the encrypted data. identifying an entity-trusted application on the computing device, the entity-trusted application configured to access data, and the entity-trusted application being an enlightened application; associating a first process that is a running instance of the entity-trusted application with an identifier of an entity that sets a data protection policy controlling access to the data; and enforcing, by an operating system of the computing device, the data protection policy of the entity to enhance data security provided by the computing device due to the operating system enforcing the data protection policy on behalf of the entity-trusted application, wherein enforcing the data protection policy includes enforcing the data protection policy in response to a request from the first process for the operating system to treat the enlightened application as an unenlightened application, wherein the enlightened application can switch between operating in an enlightened mode and an unenlightened mode and this switch is performed by the process that is a running instance of the enlightened application requesting that the operating system treat the enlightened application as an unenlightened application, wherein in the enlightened mode, the operating system allows the process that is a running instance of the enlightened application to protect the data in accordance with the data protection policy, and in the unenlightened mode, the operating system performs encryption and decryption, and otherwise operates to maintain the protection on the data in accordance with the data protection policy, and the operating system performs these operations on behalf of the process that is a running instance of the enlightened application as if the enlightened application were an unenlightened application, and the enforcing including: obtaining, by the operating system, the data protection policy; automatically encrypting, by the operating system in accordance with the data protection policy, data saved by the first process; saving the encrypted data in a container file that includes both metadata and the encrypted data, the metadata including the identifier of the entity; and preventing, by the operating system in accordance with the data protection policy, a second process that is a running instance of an entity-untrusted application from accessing the encrypted data. obtaining, by the operating system, the data protection policy; automatically encrypting, by the operating system in accordance with the data protection policy, data saved by the first process; saving the encrypted data in a container file that includes both metadata and the encrypted data, the metadata including the identifier of the entity; and preventing, by the operating system in accordance with the data protection policy, a second process that is a running instance of an entity-untrusted application from accessing the encrypted data.