Abstract: The subject disclosure is directed towards resource sharing and/or isolation in a role based access (RBA) system. A resource may be associated with an owner, via an owner property, which provides isolation by enforcing exclusive access to that resource by the owner (unless the owner chooses to share). Sharing is provided by allowing the owner to identify, in a GrantedTo list, selected receiving user(s) or user role(s) that can have shared access. Also described is administrator-level control over the ability to share resources and/or receive shared resources, e.g., an administrator selects whether a resource owner is permitted to share resources and/or whether receiving users/user roles are permitted to receive shared resources.

Abstract: An administrative authority for virtual machines can send one or more delegated policy settings to a virtual machine manager. The virtual machine manager can in turn send management instructions that include the one or more policy settings to one or more virtual machine hosts. As such, a user's request for a virtual machine at a virtual machine host can be granted or denied based on the delegated policy settings. The policy settings can be updated periodically, and can include additional information about starting, stopping, expiring, saving, or even deleting virtual machines by particular users, as well as users accessing from particular locations. In addition, an agent operating at the virtual machine host can monitor and report virtual machine activity, to ensure unauthorized virtual machines are quickly stopped and reviewed until authorized.

Abstract: The embodiments contemplate a system and method for a restriction of virtual machines for a group of one or more users. A predefined policy may include a restriction related to the group, as well as a measure of enforcement to initiate in the event of a violation of the restriction. The measure of enforcement may include a warning message or denial of resources. The restriction may be resource-based, time-based, machine-based, or a combination. The restriction may be a group-level restriction, in which the entire group actions are monitored, or a user-level restriction, in which the user's actions are monitored. In the event a user is assigned to more than one group, the policies of each group are assigned a priority level. The priority level dictates the restriction as well as the measure of enforcement.