When people hear "DRM," they picture cryptography: keys, ciphers, the dark art of stopping a video from being copied. That part is real, and on a creator platform that sells video, it is also the easy half. The maths is solved. There are well-understood encryption schemes and well-understood providers to hold the keys. You can buy the hard cryptography.

What you cannot buy is the answer to the only question that actually matters: is this viewer, right now, allowed to watch this video?

That is not a cryptography question. It is a commerce question. And if you build your protection as if it were about ciphers, you will end up with beautifully encrypted content and no coherent way to say who paid for it.

Encrypt once, license per viewer

The shape that works is simple to state and easy to get wrong. Encrypt the content once. Decide access per viewer, every single time a player asks to play.

Encrypting once is not a shortcut; it is the point. The encrypted segments are the same bytes for everyone.…