1. A computer-implemented method comprising: providing a blocking mechanism that is configured to block Internet-application access to defined spaces of a client computing device on which the Internet-application executes; defining at least one containment zone in which said Internet-application is to write and read data; and brokering access to said defined spaces for said Internet-application.