1. A method for managing documents with sensitive information at an endpoint of a system, the method comprising: identifying, by an agent configured as software elements programmed to run on a computing device, a target document and an associated current process activity, wherein the associated current process activity comprises an operation to be performed on the target document; determining, by the agent, whether the target document is an outgoing document which is a document that is to be exported out of the endpoint; if the target document is determined to not be an outgoing document, then identifying, by the agent, a behavior applied to the target document; determining, by the agent, whether the target document contains sensitive information; and responsive to the target document containing the sensitive information, the agent determining whether the current process activity is to be blocked allowed or modified, wherein after the agent identifies the target document and the associated current process activity, the agent holds the current process activity, notifies a behavior analysis engine of the target document and the current process activity, and waits for a signal from the behavior analysis engine indicating whether to continue with the current process activity, wherein the agent raises an exception and stops the current process activity if the agent is signaled by the behavior analysis engine to block the current process activity, otherwise the agent lets the current process activity to continue.