At a computer system, a method for providing access to protected content, the method comprising: an act of the computer system detecting that a user is attempting to access protected content through an application at the computer system, the protected content protected in accordance with a protection policy managed by a digital rights management, DRM, system that includes a separate digital rights management server, the protection policy including an application set and one or more computing environments, the application set identifying a set of applications that are allowed to access the content; prior to allowing the application to access the protected content: an act of the computer system exchanging information with the digital rights management server, the information including one or more attributes of the computer system's operating environment and user authentication information for the user, the one or more attributes used by the DRM server to determine that the computer system is trusted to evaluate whether the application is in the application set; based at least in part on the computer system exchanging information with the DRM server, an act of the computer system obtaining a user key corresponding to the user, the user key being usable for accessing the protected content, the user key issued by the DRM server after determining that the user is authorized to access the protected content and after determining that the computer system is trusted to evaluate whether the application is in the application set; and an act of the computer system determining that the application is in the application set; and subsequent to the computer system determining that the application is in the application set, an act of the computer system allowing the application to use the user key to access the protected content. an act of the computer system detecting that a user is attempting to access protected content through an application at the computer system, the protected content protected in accordance with a protection policy managed by a digital rights management, DRM, system that includes a separate digital rights management server, the protection policy including an application set and one or more computing environments, the application set identifying a set of applications that are allowed to access the content; prior to allowing the application to access the protected content: an act of the computer system exchanging information with the digital rights management server, the information including one or more attributes of the computer system's operating environment and user authentication information for the user, the one or more attributes used by the DRM server to determine that the computer system is trusted to evaluate whether the application is in the application set; based at least in part on the computer system exchanging information with the DRM server, an act of the computer system obtaining a user key corresponding to the user, the user key being usable for accessing the protected content, the user key issued by the DRM server after determining that the user is authorized to access the protected content and after determining that the computer system is trusted to evaluate whether the application is in the application set; and an act of the computer system determining that the application is in the application set; and an act of the computer system exchanging information with the digital rights management server, the information including one or more attributes of the computer system's operating environment and user authentication information for the user, the one or more attributes used by the DRM server to determine that the computer system is trusted to evaluate whether the application is in the application set; based at least in part on the computer system exchanging information with the DRM server, an act of the computer system obtaining a user key corresponding to the user, the user key being usable for accessing the protected content, the user key issued by the DRM server after determining that the user is authorized to access the protected content and after determining that the computer system is trusted to evaluate whether the application is in the application set; and an act of the computer system determining that the application is in the application set; and subsequent to the computer system determining that the application is in the application set, an act of the computer system allowing the application to use the user key to access the protected content.