A system, comprising: a traffic stack; a proxy manager coupled to the traffic stack; a socket manager coupled to the traffic stack; a traffic classification and enforcement engine coupled to the traffic stack; wherein, in operation: the proxy manager is configured to tag a network activity traffic flow at a first point in the flow, wherein the first point is associated with an API call to the proxy manager for a thread; the proxy manager is configured to register the thread at the traffic stack; the socket manager is configured to tag the network activity traffic flow at a second point in the flow, wherein the second point is associated with a socket call to the socket manager for the thread; the socket manager is configured to register the socket at the traffic stack; the traffic classification and enforcement engine is configured to use the registration of the thread and the registration of the socket to determine that the network activity traffic flow is associated with an initiator of the network activity, the initiator of the network activity being different from the proxy manager; the traffic classification and enforcement engine is configured to enforce service policies associated with the initiator of the network activity for the network activity traffic flow. a traffic stack; a proxy manager coupled to the traffic stack; a socket manager coupled to the traffic stack; a traffic classification and enforcement engine coupled to the traffic stack; wherein, in operation: the proxy manager is configured to tag a network activity traffic flow at a first point in the flow, wherein the first point is associated with an API call to the proxy manager for a thread; the proxy manager is configured to register the thread at the traffic stack; the socket manager is configured to tag the network activity traffic flow at a second point in the flow, wherein the second point is associated with a socket call to the socket manager for the thread; the socket manager is configured to register the socket at the traffic stack; the traffic classification and enforcement engine is configured to use the registration of the thread and the registration of the socket to determine that the network activity traffic flow is associated with an initiator of the network activity, the initiator of the network activity being different from the proxy manager; the traffic classification and enforcement engine is configured to enforce service policies associated with the initiator of the network activity for the network activity traffic flow. the proxy manager is configured to tag a network activity traffic flow at a first point in the flow, wherein the first point is associated with an API call to the proxy manager for a thread; the proxy manager is configured to register the thread at the traffic stack; the socket manager is configured to tag the network activity traffic flow at a second point in the flow, wherein the second point is associated with a socket call to the socket manager for the thread; the socket manager is configured to register the socket at the traffic stack; the traffic classification and enforcement engine is configured to use the registration of the thread and the registration of the socket to determine that the network activity traffic flow is associated with an initiator of the network activity, the initiator of the network activity being different from the proxy manager; the traffic classification and enforcement engine is configured to enforce service policies associated with the initiator of the network activity for the network activity traffic flow.