1. One or more computer-readable storage device having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising: receiving, at a virtual machine monitor operating in a virtual machine monitor privilege mode, a request that a range of memory be made unalterable or inaccessible from an operating-system privilege mode; making the range of memory unalterable or inaccessible from the operating-system privilege mode; and running a protection agent operating in a protection-agent privilege mode, that resides within the range of memory, wherein the protection agent is configured to receive an enforcement policy describing one or more resources operating in a first partition, the one or more resources accessible from the operating system privilege mode and, in response to the receiving of the enforcement policy, determine, with use of the enforcement policy and from the range of memory resident to a second partition inaccessible from the operating-system privilege mode, whether one or more of the one or more resources operating in the first partition have been altered, wherein the protection-agent privilege mode is more privileged than the operating-system privilege mode but less privileged than the virtual machine monitor privilege mode.