diff --git a/src/include/tpm_lite/tlcl.h b/src/include/tpm_lite/tlcl.h
index c777ff9..1a4f638 100644
--- a/src/include/tpm_lite/tlcl.h
+++ b/src/include/tpm_lite/tlcl.h
@@ -67,22 +67,11 @@
 #elif IS_ENABLED(CONFIG_TPM2)
 
 /*
- * This enum allows to communicate firmware privilege levels to the TPM layer,
- * which can map them into its own attributes.
+ * Define a TPM space. The define space command TPM command used by the tlcl
+ * layer is enforcing the policy which would not allow to delete the created
+ * space after any PCR0 change from its initial value.
  */
-enum privilege_level {
-	high_privilege = 1,
-	low_privilege
-};
-
-/*
- * Define a TPM space. Privilege level describes who can modify the space
- * (high_privilege - the RO code only, low_privilege - ether RO or RW. The
- * privilege level needs to be dropped below low_privilege before starting the
- * kernel.
- */
-uint32_t tlcl_define_space(uint32_t space_index,
-			   enum privilege_level priv_level, size_t space_size);
+uint32_t tlcl_define_space(uint32_t space_index, size_t space_size);
 #endif
 
 /**
diff --git a/src/lib/tpm2_tlcl.c b/src/lib/tpm2_tlcl.c
index c352a2c..8412ed0 100644
--- a/src/lib/tpm2_tlcl.c
+++ b/src/lib/tpm2_tlcl.c
@@ -248,11 +248,20 @@
 	return TPM_SUCCESS;
 }
 
-uint32_t tlcl_define_space(uint32_t space_index,
-			   enum privilege_level priv_level, size_t space_size)
+uint32_t tlcl_define_space(uint32_t space_index, size_t space_size)
 {
 	struct tpm2_nv_define_space_cmd nvds_cmd;
 	struct tpm2_response *response;
+	/*
+	 * This policy digest was obtained using TPM2_PolicyPCR selecting only
+	 * PCR_0 with a value of all zeros.
+	 */
+	static const uint8_t pcr0_unchanged_policy[] = {
+		0x09, 0x93, 0x3C, 0xCE, 0xEB, 0xB4, 0x41, 0x11,
+		0x18, 0x81, 0x1D, 0xD4, 0x47, 0x78, 0x80, 0x08,
+		0x88, 0x86, 0x62, 0x2D, 0xD7, 0x79, 0x94, 0x46,
+		0x62, 0x26, 0x68, 0x8E, 0xEE, 0xE6, 0x6A, 0xA1
+	};
 
 	/* Prepare the define space command structure. */
 	memset(&nvds_cmd, 0, sizeof(nvds_cmd));
@@ -261,16 +270,21 @@
 	nvds_cmd.publicInfo.nvIndex = HR_NV_INDEX + space_index;
 	nvds_cmd.publicInfo.nameAlg = TPM_ALG_SHA256;
 
-	/* Attributes common for all privilege levels. */
+	/* Attributes common for all NV ram spaces used by firmware. */
 	nvds_cmd.publicInfo.attributes.TPMA_NV_PPWRITE = 1;
 	nvds_cmd.publicInfo.attributes.TPMA_NV_AUTHREAD = 1;
 	nvds_cmd.publicInfo.attributes.TPMA_NV_PPREAD = 1;
 	nvds_cmd.publicInfo.attributes.TPMA_NV_PLATFORMCREATE = 1;
+	nvds_cmd.publicInfo.attributes.TPMA_NV_WRITE_STCLEAR = 1;
+	nvds_cmd.publicInfo.attributes.TPMA_NV_POLICY_DELETE = 1;
 
-	if (priv_level == high_privilege) {
-		nvds_cmd.publicInfo.attributes.TPMA_NV_WRITE_STCLEAR = 1;
-		nvds_cmd.publicInfo.attributes.TPMA_NV_POLICY_DELETE = 1;
-	}
+	/*
+	 * Use policy digest based on default pcr0 value. This makes sure that
+	 * the space can not be deleted as soon as PCR0 value has been
+	 * extended from default.
+	 */
+	nvds_cmd.publicInfo.authPolicy.t.buffer = pcr0_unchanged_policy;
+	nvds_cmd.publicInfo.authPolicy.t.size = sizeof(pcr0_unchanged_policy);
 
 	response = tpm_process_command(TPM2_NV_DefineSpace, &nvds_cmd);
 	printk(BIOS_INFO, "%s: response is %x\n",
diff --git a/src/vendorcode/google/chromeos/vboot2/antirollback.c b/src/vendorcode/google/chromeos/vboot2/antirollback.c
index 621758a..bce2ca1 100644
--- a/src/vendorcode/google/chromeos/vboot2/antirollback.c
+++ b/src/vendorcode/google/chromeos/vboot2/antirollback.c
@@ -128,7 +128,6 @@
 static uint32_t set_firmware_space(const void *firmware_blob)
 {
 	RETURN_ON_FAILURE(tlcl_define_space(FIRMWARE_NV_INDEX,
-					    high_privilege,
 					    VB2_SECDATA_SIZE));
 	RETURN_ON_FAILURE(safe_write(FIRMWARE_NV_INDEX, firmware_blob,
 				     VB2_SECDATA_SIZE));
@@ -138,7 +137,6 @@
 static uint32_t set_kernel_space(const void *kernel_blob)
 {
 	RETURN_ON_FAILURE(tlcl_define_space(KERNEL_NV_INDEX,
-					    low_privilege,
 					    sizeof(secdata_kernel)));
 	RETURN_ON_FAILURE(safe_write(KERNEL_NV_INDEX, kernel_blob,
 				     sizeof(secdata_kernel)));