Abstract: An enterprise security system for controlling access of users to sensitive information content in an organization is provided herein. The system includes a processor and a memory. The system includes a classify module configured to classify sensitive information content into types of sensitive information content. The enterprise security system further includes a rules module configured to construct rules for mapping each user's request for each type of sensitive information content into one of three outcomes, the outcomes include ‘allow’, ‘block’, and ‘allow if reason’. The system further includes a map module configured to receive a user's request for a type of sensitive information content, and map the user's request into one of the three outcomes, based on the rules constructed. The system further includes an access module configured to allow access to the user to the type of sensitive information content, based on the one of the three outcomes.