A method for controlling application operations on data elements, comprising: identifying an activity by an instance of an application running on a host to perform an operation with respect to a data element; obtaining an application label comprising information regarding a source of the application, the source of the application comprising at least one parent process in a first hierarchy of processes associated with the application; obtaining a data element label comprising information regarding a source of the data element, the source of the data element comprising a list of parent processes associated with creation of the data element, the list being optimized to eliminate one or more processes based on at least one rule; determining, based on an analysis of the source of the application and the data element label, an operational policy governing operation of the instance of the application with respect to the data element; and applying a control action to the operation associated with the data element according to the operational policy, so as to control the operation by the instance of the application with respect to the data element, wherein applying the control action to the operation according to the operational policy comprises at least one of: blocking operation of the instance of the application; controlling access by the instance of the application to the data element; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy. identifying an activity by an instance of an application running on a host to perform an operation with respect to a data element; obtaining an application label comprising information regarding a source of the application, the source of the application comprising at least one parent process in a first hierarchy of processes associated with the application; obtaining a data element label comprising information regarding a source of the data element, the source of the data element comprising a list of parent processes associated with creation of the data element, the list being optimized to eliminate one or more processes based on at least one rule; determining, based on an analysis of the source of the application and the data element label, an operational policy governing operation of the instance of the application with respect to the data element; and applying a control action to the operation associated with the data element according to the operational policy, so as to control the operation by the instance of the application with respect to the data element, wherein applying the control action to the operation according to the operational policy comprises at least one of: blocking operation of the instance of the application; controlling access by the instance of the application to the data element; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy. blocking operation of the instance of the application; controlling access by the instance of the application to the data element; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy.