A method and system for managing document dissemination are disclosed, including obtaining a plurality of operation logs from a plurality of local agents, where each of the plurality of local agents is executing on one of a plurality of clients. The method further includes identifying a document stored on a client of the plurality of clients, determining, using at least one of the plurality of operation logs, a dissemination path of the document between the plurality of clients, and performing an action based on the dissemination path of the document.