Abstract: A system for controlling access to computing-device resources and files based on user authentication, comprising: a) a Policy Specification Interface (PSI) configured to allow an administrator to configure system access policies per execution context, specified as either a program execution path or a process ID; b) a Policy Enforcement Driver (PED) configured to receive input and output (I/O) requests from an I/O manager of the computing device and decide how to handle each I/O request according to the system access policies; and c) a Challenge-Response Generator (CRG) configured to present a challenge to a user in order to recognize a bot or a human user.