A data leak prevention system includes an application, having source code that is unavailable or non-modifiable, resident on a client device. A system call is emittable by the application as a result of an action, and is to take place before a data leak event can occur. The action involves a document and i) latest full contents of the document, ii) metadata of the document, or iii) a combination of the latest full contents and the metadata. A system call interceptor agent is also resident on the client device. The interceptor agent includes a system call interceptor to intercept the system call emitted by the application and to suspend the system call. The system also includes a policy decision engine to analyze at least some of i) the latest full contents, ii) the metadata, or iii) the combination, and implement a policy action based upon the analysis.