Policy-driven isolation