Abstract: Hypercalls for a host machine and guest machines to a hypervisor are intercepted and routed to the hypervisor for execution on a hardware platform, responsive to the hypercall passing hypercall access rules. The intercepting may be performed by a hypercall access control layer that reloads a hypercall table that maps hypercalls from a host machine and guest machines to hypercall handlers, to identify a hypercall access control handler as the hypercall handler for the host machine and the guest machines. Upon passing the hypercall access rules, the hypercall is passed to the hypervisor.

Abstract: Multiple personas associated with an identity are managed. Managing multiple personas may comprise providing a list of available personas associated with an authenticated user on a workspace, each available persona comprising policy information and configuration information, receiving a selection of a persona selected from the list of available personas and providing policy information and configuration information to a security enforcement point for a program for the selected persona. The persona can also include authentication information. The policy information may be used to determine access to a program.