1. A method comprising, by an information handling system comprising a processor and memory: receiving information related to a platform-portable workload, the information comprising a data security policy expressed as digitally signed metadata, wherein the data security policy specifies one or more data security features that any platform allowed to execute the platform-portable workload is to implement; validating the digitally signed metadata as originating from an issuer computer system that issued the platform-portable workload; responsive to the validating, automatically determining that a particular platform cannot satisfy the data security policy based, at least in part, on a comparison of the digitally signed metadata with data security attributes of the particular platform; and responsive to the automatically determining, automatically preventing execution of the platform-portable workload on the particular platform, wherein the automatically preventing comprises: selecting a second platform that is determined to satisfy the data security policy; and transmitting the platform-portable workload to the second platform for execution.