When an application needs access to system resources, it makes an operating system call to the kernel. Cisco Security Agent intercepts these operating system calls and compares them with the cached security policy. If the request does not violate the policy, it is passed to the kernel for execution.