The ability to protect sensitive information from being read or modified by administrators who have access to a file system but are not authorized to read the protected data within certain files. Also the ability to monitor changes to sensitive files to audit who is making changes to them or reading them.