Patent ID: 8583788

Claim:
A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising: intercepting a command instruction sere from a principal in a first processing environment to a network service in a second processing environment; generating a causation audit event based on the command instruction; evaluating a policy based on the causation audit event and permitting the command instruction to be passed to the network service for processing in response to a successful evaluation of the policy; detecting a response from the fretwork service being directed to the principal; generating an effect audit event; evaluating a second policy based on the effect audit event and permitting the response to be passed to the principal in response to a successful evaluation of the second policy; wherein generating the causation event further includes setting a timer that is started when the command instruction is passed to the network service and that is terminated when the response is detected from the network service and recording a relationship within a metrics data store that records a relation for an elapsed time associated with the timer and a state of the second processing environment along with the command instruction, a principal identity for the principal, and a network service identity for the network service; and capturing a new state of the second processing environment and retrieving the relation for evaluation with the policy when a second instance of the command instruction is received from the principal or a different principal.