1. A method of accessing content according to a DRM policy, comprising: communicating, using a service access point of a device, with one or more web services agents to receive: a content object including an encrypted content item, a license object comprising a control object including a control program containing instructions for querying an authorization graph for an existence of a path from a first node to a second node, and a content key object including an encrypted content key for decrypting the encrypted content item, a first link object associated with a validity constraint comprising authorization conditions governing the use of a first link key to sign the first link object, the authorization conditions expressed by a control program, a certificate for the first link key comprising the constraint program; determining authorization to access the encrypted content item using a DRM engine on the device, the DRM engine requesting cryptographic services from a host environment, comprising: verifying, by the DRM engine, the license object, validating, by the DRM engine, the first link object according to the validity constraint and cryptographic services requested from the host environment, validation comprising: determining satisfaction of the authorization conditions for the first link key by executing the constraint program using the DRM engine, verifying the certificate for the first link key based on satisfaction of the authorization conditions using the cryptographic services, and validating the first link object based on verification of the certificate using the DRM engine, constructing, by the DRM engine, an authorization graph comprising nodes connected by links, construction using valid link objects, the valid link objects comprising the first link object, and querying, by the DRM engine, the authorization graph by executing the control program and determining by the control program the existence of the path from the first node to the second node; providing by the DRM engine based on a result of the query: an indication that the encrypted content item may be accessed, and a decrypted version of the encrypted content key for decrypting the encrypted content item; generating a decrypted version of the encrypted content item by decrypting the encrypted content item using the decrypted version of the encrypted content key, based on the indication; and accessing the decrypted version of the encrypted content item based on the indication.