1. A system comprising one or more processors coupled to a memory, the one or more processors when executing logic encoded in the memory providing: a policy life cycle component, configured to: maintain a repository of security policies, the repository of security policies comprising policies governing access to a virtual host and to a plurality of virtual machines running on the virtual host; and issue a compound policy for an identified virtual operating system running on the virtual host, the compound policy providing a virtual host policy and access rules for each of the plurality of virtual machines running on the virtual host; and a topology manager, configured to: receive the compound policy from the policy life cycle component; assign the compound policy to an access control agent; and maintain a security policy topology, the security policy topology storing associations between access control agents and compound policies; the access control agent further configured to: recognize one of the plurality of virtual machines running on the virtual host; validate the location of the one of the plurality of virtual machines on the virtual host; and prevent the one of the plurality of virtual machines from roaming off of the virtual host.