1. An apparatus for controlling access to digital assets in a data processing environment comprising: an atomic level asset access event sensor, located within an operating system kernel within a user client device to sense atomic level events; an aggregator, to aggregate multiple atomic level events to determine a combined event; and an encryptor, to assert an encryption policy if a at least one combined event has occurred that matches a predefined digital asset usage risk policy.