A method, comprising: storing, by a policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies; receiving, from a client device by the policy enforcement system, a request for data from a file system, the request further comprising user credentials; forwarding, by the policy enforcement system, the request to a first node at the file system; receiving, from the first node at the policy enforcement system, a redirect request comprising data specifying a second node that stores the data from the file system; appending, by the policy enforcement, the user credentials to the redirect request to generate a custom redirect request; responding by the policy enforcement system to the client device with the custom redirect request; receiving, from the client device by the policy enforcement system, a request for data from the second node, the request for data from the second node having the user credentials; forwarding, by the policy enforcement system, the request for data from the second node to the second node that stores the data from the file system; receiving, by the policy enforcement, system, the data from the file system from the second node; selecting, by the policy enforcement system, from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials; filtering, by the policy enforcement, system, the data from the file system based on the selected one or more policies; and sending, by the policy enforcement system, the filtered data to the client device. storing, by a policy enforcement system, a plurality of policies and data associating a plurality of user credentials with the plurality of policies; receiving, from a client device by the policy enforcement system, a request for data from a file system, the request further comprising user credentials; forwarding, by the policy enforcement system, the request to a first node at the file system; receiving, from the first node at the policy enforcement system, a redirect request comprising data specifying a second node that stores the data from the file system; appending, by the policy enforcement, the user credentials to the redirect request to generate a custom redirect request; responding by the policy enforcement system to the client device with the custom redirect request; receiving, from the client device by the policy enforcement system, a request for data from the second node, the request for data from the second node having the user credentials; forwarding, by the policy enforcement system, the request for data from the second node to the second node that stores the data from the file system; receiving, by the policy enforcement, system, the data from the file system from the second node; selecting, by the policy enforcement system, from the plurality of policies, based on the received user credentials and the data associating the plurality of user credentials with the plurality of policies, one or more policies that correspond to the received user credentials; filtering, by the policy enforcement, system, the data from the file system based on the selected one or more policies; and sending, by the policy enforcement system, the filtered data to the client device.