Policy management, enforcement, and audit for data security