1. An agent process for controlling access to digital assets in a network of data processing devices, the process comprising: defining a security perimeter that includes two or more data processing devices in the network, each of the data processing devices including an operating system kernel, and at least one of the data processing devices being a user client device having access to a digital asset; defining one or more policy violation predicates implementing policy logic to control access to the digital asset by an end user of the user client device; sensing atomic events within the operating system kernel of the user client device, the atomic events being low level kernel events and being sensed upon actions relating to authorized access to the digital asset by the end user of the user client device; aggregating multiple atomic level events sensed within the user client device to determine a combined event; and asserting a policy violation predicate, at the user client device, upon an occurrence of a combined event that violates the policy logic, the policy logic violation corresponding to a risk of use of the digital asset outside of the security perimeter.