1. A computer-implemented method comprising: receiving, at a process manager running on a computer system, a request to run a particular process on the computer system; determining, by the process manager, whether the particular process is to be run in isolation on the computer system; selecting, by the process manager and in response to determining that the particular process is to be run in isolation, a particular permission scheme from among a plurality of permission schemes based, at least in part, on one or more characteristics of the particular process, wherein each of the plurality of permission schemes defines a different set of permission requirements for applying changes to a process being run in isolation; fetching, by the process manager and according to the particular permission scheme, a copy object that corresponds to an actual object for the particular process, wherein the copy object is instantiated in an isolated environment on the computer system; running the particular process is isolation on the computer system by executing the copy object in the isolated environment; applying, by the process manager and according to the particular permission scheme, one or more changes to the copy object; and mapping, by the process manager and according to the particular permission scheme, the one or more changes in the copy object to the actual object.