Patent ID: 7877781

Claim:
A method of controlling document access using centrally managed rules, the method comprising: providing a first server comprising a plurality of rules stored in a central rule database, wherein each rule comprises a logical expression having a rule element and a corresponding action that will be performed when the logical expression is satisfied; distributing a first subset of the plurality of rules to a first client from the central rule database, wherein the first subset of the plurality of rules distributed to the first client contain at least one logical expression having a rule element and a corresponding action used by the first client to perform access control for documents accessed by the first client; distributing a second subset of the plurality of rules to a second server from the central rule database, wherein the second subset of the plurality of rules distributed to the second server contain at least one logical expression having a rule element and a corresponding action used by the second server to perform access control for documents stored on the second server; receiving an indication from a second client that a policy enforcer program is not active on the second client; detecting an attempt by an application program on the second client to access a first document stored on the second server; based on the received indication from the second client that the policy enforcer program is not active on the second client, at the second server, evaluating at least one rule from the second subset of the plurality of rules distributed to the second server to determine whether or not to allow the access attempt of a first document stored on the second server; when the at least one rule is satisfied, allowing the access attempt; when the at least one rule is not satisfied, disallowing the access attempt; receiving an indication from the first client that a policy enforcer program is active on the first client; detecting an attempt by an application program on the first client to access the first document stored on the second server; and based on the received indication from the first client that the policy enforcer program is active on the first client, allowing the access attempt.