Policy-driven, layered isolation and containment