A method of implementing a processing policy on a computer, comprising: an interceptor detecting first and second events, each having one of a plurality of defined event types, the events being operating system requests by applications for access to operating system resources; the interceptor generating first and second event messages, each containing information about a corresponding one of the first and second events, wherein events are identified in event messages to the application which produced the event; the interceptor communicating the event messages to a stateful reference monitor, wherein the stateful reference monitor retains and relies on changing system state information in implementing decision policies, the stateful reference monitor comprising: a set of rules; a state database where real-time system state information for the computer is stored and from which the state information is restored, and a rule interpreter for interpreting the rules, the rule interpreter determining whether the event described by the first event message is of a type designated as part of the changing system state information to be stored in the state database, if so, the state database storing the information about the first event; and enforcing the policy responsive to the stored information about the first event and the information about the second event, the stateful reference monitor treating the second event message as a request for an interpretation of the second event, the stateful reference monitor interpreting the communicated second event message by applying the rules to the event in light of the current content of the state database and based on the application of the rules and the state of the computer as stored in the state database and returning a policy message to the interceptor which enforces the policy. an interceptor detecting first and second events, each having one of a plurality of defined event types, the events being operating system requests by applications for access to operating system resources; the interceptor generating first and second event messages, each containing information about a corresponding one of the first and second events, wherein events are identified in event messages to the application which produced the event; the interceptor communicating the event messages to a stateful reference monitor, wherein the stateful reference monitor retains and relies on changing system state information in implementing decision policies, the stateful reference monitor comprising: a set of rules; a state database where real-time system state information for the computer is stored and from which the state information is restored, and a rule interpreter for interpreting the rules, a set of rules; a state database where real-time system state information for the computer is stored and from which the state information is restored, and a rule interpreter for interpreting the rules, the rule interpreter determining whether the event described by the first event message is of a type designated as part of the changing system state information to be stored in the state database, if so, the state database storing the information about the first event; and enforcing the policy responsive to the stored information about the first event and the information about the second event, the stateful reference monitor treating the second event message as a request for an interpretation of the second event, the stateful reference monitor interpreting the communicated second event message by applying the rules to the event in light of the current content of the state database and based on the application of the rules and the state of the computer as stored in the state database and returning a policy message to the interceptor which enforces the policy.