A system and method for restricting data access from an electronic document configured to access external data resources (e.g., websites, disk storage). To restrict unwanted data sharing, the document is prohibited from accessing external data resources unless it has a token corresponding to the resource. “Get” tokens and “send” tokens are granted, respectively, whenever the document is permitted to receive data from or send data to a data resource. Every attempt to receive data is automatically approved. An attempt to send data is approved automatically only if the document: (a) has no get tokens, (b) has only one get token and is attempting to send to the same resource, or (c) already has a send token corresponding to the resource and the set of get tokens has not changed since data was last sent to the resource. Otherwise, the attempt must be approved by an operator or data access policy.