A method for controlling application operations on data elements, comprising: identifying an activity by an instance of an application running on a host to perform an operation with respect to a data element ; obtaining an application label comprising information regarding a source of the application , the source of the application comprising at least one parent process in a first hierarchy of processes associated with the application; obtaining a data element label comprising information regarding a source of the data element , the source of the data element comprising a list of parent processes associated with creation of the data element , the list being optimized to eliminate one or more processes based on at least one rule; determining , based on an analysis of the source of the application and the data element label , an operational policy governing operation of the instance of the application with respect to the data element ; and applying a control action to the operation associated with the data element according to the operational policy , so as to control the operation by the instance of the application with respect to the data element , wherein applying the control action to the operation according to the operational policy comprises at least one of: blocking operation of the instance of the application ; controlling access by the instance of the application to the data element ; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy . identifying an activity by an instance of an application running on a host to perform an operation with respect to a data element ; obtaining an application label comprising information regarding a source of the application , the source of the application comprising at least one parent process in a first hierarchy of processes associated with the application; obtaining a data element label comprising information regarding a source of the data element , the source of the data element comprising a list of parent processes associated with creation of the data element , the list being optimized to eliminate one or more processes based on at least one rule; determining , based on an analysis of the source of the application and the data element label , an operational policy governing operation of the instance of the application with respect to the data element ; and applying a control action to the operation associated with the data element according to the operational policy , so as to control the operation by the instance of the application with respect to the data element , wherein applying the control action to the operation according to the operational policy comprises at least one of: blocking operation of the instance of the application ; controlling access by the instance of the application to the data element ; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy . blocking operation of the instance of the application ; controlling access by the instance of the application to the data element ; or dynamically monitoring operations performed by the instance of the application on the data element to identify violations of the operational policy . <EOS>