1. A computer system comprising: system hardware, including one or more physical processors, one or more physical memories, and one or more physical mass-storage devices; a virtualization layer, including multiple virtual device emulators and a virtual policy enforcer, that executes on one or more of the one or more physical processors; and one or more virtual machines, each virtual machine authorized to execute in the computer system by policy control data stored in one or more of the one or more physical mass-storage devices accessed by the virtual policy enforcer, each virtual machine including a virtual hardware platform implemented by one or more of the multiple device emulators within the virtualization layer, a guest operating system that provides an application-program execution environment, and an application program that executes within the application-program execution environment and that is licensed to execute by a license module that accesses license control information stored in one or more of the one or more physical mass-storage devices, wherein the virtual policy enforcer controls access to the policy control data, the policy control data encrypted and stored within one or more policy control files on one or more of the one or more physical mass-storage devices, the policy control data decrypted by a cipher function library included in the virtualization layer when the virtual policy enforcer accesses one or more of the one or more policy control files.