1. A computer-implemented method comprising: associating, by a host controller, each of a plurality of virtual machines with at least one label from a hierarchy of labels, each of the labels representing a distinct virtual machine parameter; associating, by the host controller, a user with one or more of a plurality of roles and with one or more labels from the hierarchy of labels, each of the plurality of roles defining at least one action permitted to be performed with respect to virtual machines; and facilitating, by the host controller, control over user actions pertaining to virtual machines based on the one or more roles and the one or more labels associated with the user.