A system for controlling access to a security asset, the system comprising: one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: receiving, by a trusted platform module access module, a request from a process to generate an authorization principal that corresponds to a representation of an operating system context in a trusted platform module, wherein the authorization principal comprises a condition for controlling access to a security asset, wherein the security asset comprises one or more of a security key, a security certificate, or protected data stored within the trusted platform module; interfacing with the trusted platform module to bind the authorization principal within the trusted platform module to the security asset stored in the trusted platform module; receiving a request for access to the authorization principal; and taking an action based on whether a request context for the request matches the authorization principal corresponding to the representation of the operating system context comprising one or more of an application identifier, a group identifier, or a privilege level, wherein the request context corresponds to an operating system context for a process that requests the access to the authorization principal, the action including one of: allowing access to the security asset by allowing access to the authorization principal in response to a request context matching the authorization principal; or not allowing access to the security asset by denying access to the authorization principal in response to the request context not matching the authorization principal. one or more processors; and one or more computer-readable storage media storing computer-executable instructions that, responsive to execution by the one or more processors, cause the system to perform operations including: receiving, by a trusted platform module access module, a request from a process to generate an authorization principal that corresponds to a representation of an operating system context in a trusted platform module, wherein the authorization principal comprises a condition for controlling access to a security asset, wherein the security asset comprises one or more of a security key, a security certificate, or protected data stored within the trusted platform module; interfacing with the trusted platform module to bind the authorization principal within the trusted platform module to the security asset stored in the trusted platform module; receiving a request for access to the authorization principal; and taking an action based on whether a request context for the request matches the authorization principal corresponding to the representation of the operating system context comprising one or more of an application identifier, a group identifier, or a privilege level, wherein the request context corresponds to an operating system context for a process that requests the access to the authorization principal, the action including one of: allowing access to the security asset by allowing access to the authorization principal in response to a request context matching the authorization principal; or not allowing access to the security asset by denying access to the authorization principal in response to the request context not matching the authorization principal. receiving, by a trusted platform module access module, a request from a process to generate an authorization principal that corresponds to a representation of an operating system context in a trusted platform module, wherein the authorization principal comprises a condition for controlling access to a security asset, wherein the security asset comprises one or more of a security key, a security certificate, or protected data stored within the trusted platform module; interfacing with the trusted platform module to bind the authorization principal within the trusted platform module to the security asset stored in the trusted platform module; receiving a request for access to the authorization principal; and taking an action based on whether a request context for the request matches the authorization principal corresponding to the representation of the operating system context comprising one or more of an application identifier, a group identifier, or a privilege level, wherein the request context corresponds to an operating system context for a process that requests the access to the authorization principal, the action including one of: allowing access to the security asset by allowing access to the authorization principal in response to a request context matching the authorization principal; or not allowing access to the security asset by denying access to the authorization principal in response to the request context not matching the authorization principal. allowing access to the security asset by allowing access to the authorization principal in response to a request context matching the authorization principal; or not allowing access to the security asset by denying access to the authorization principal in response to the request context not matching the authorization principal.