A method for protecting documents includes assigning electronic marks to a document. The marks are assigned based on a context of the document. Access activity with respect to the document is monitored continuously. In response to receiving a request from a user to access the document, permissions to access the document are checked by analyzing metadata of the document and access rules are analyzed. In response to determining that the marks are not included in the list of permitted marks for the user requesting the access to the document, access to the document is denied and a notification to a server is sent indicating an attempted unauthorized access to the document. Attributes of the marks are analyzed, in response to determining that the marks are included in the list of permitted marks. Access to the document is provided in accordance with the attributes of the marks.