1. A method for accessing, by application programs, resources provided by an operating system, the method comprising: (a) receiving, by a process executing inside a first application isolation scope provided by an application isolation layer, but outside second application isolation scope provided by an application isolation layer, a request for a resource and an identifier associated with the resource from a process executing inside the second application isolation scope, wherein an application isolation layer and a user isolation layer together comprise an isolation environment; (b) determining that the requested resource resides inside the first application isolation scope; (c) redirecting the request for the resource and the identifier associated with the resource to the first application isolation scope; and (d) responding to the request for the resource using an instance of the resource residing inside the first application isolation scope.