Systems and techniques are disclosed for providing a rule set from an authorization server to a broker associated with an enterprise server. The broker can be configured to receive a broker understandable restricted action request from an agent associated with the enterprise server, the request originated by an endpoint device. The request can be analyzed by the broker in view of the rule set and an approve, deny, partially approve or partially deny decision can be provided from the broker to the agent. The agent can prevent the endpoint device to performing the restricted action based on the decision provided by the broker.