Representative embodiments disclose mechanisms for flexible controls around use of cryptographic material such as encryption/decryption keys, key pairs, certificates, and so forth. The system replaces a local cryptographic agent or cryptographic service provider with a modified agent/service provider that redirects requests to utilize cryptographic key material used in a cryptographic operation to a backend system. The backend system receives the request and identifies a cryptographic process from context data associated with the request. The cryptographic process can have one or more controls attached to one or more operations in the cryptographic process. The controls are conditions that must be completed, in addition to successful completion of the underlying operation, in order to complete the underlying operation. A process owner can easily add, remove, and/or rearrange operations as well as controls to provide flexible controls around the use of cryptographic material.