A computing device has instantiated thereon a protected media path for delivering content from a source to a sink. In the protected media path, a media base provides a protected environment in the computing device and includes a common infrastructure of core components effectuating processing of content from any particular source and delivering the processed content to any particular sink, and also includes a policy engine enforcing policy on behalf of the source. The policy corresponds to the content from the source and includes rules and requirements for accessing and rendering the content, whereby the media base allows content to flow through the computing device in a protected fashion, and allows for arbitrary processing of the protected content in the computing device.