1. A method comprising: intercepting a request for a resource using a mediator at an application layer; determining, using the mediator, whether the resource is trusted or untrusted; when the resource is determined to be trusted, accessing the resource in a derived user account (DUA); and when the resource is determined to be untrusted: creating, using the mediator at the application layer, a protected DUA, wherein the protected DUA and the DUA are dynamically invoked within a same integrated user environment of a same user, redirecting, using the mediator at the application layer, the intercepted request to the protected DUA, and accessing the resource that is determined to be untrusted in the protected DUA, wherein the protected DUA provides unrestricted access to the resource.