1. A computer-implemented method comprising: associating, by a host controller, a plurality of virtual machines with labels from a hierarchy of labels in a first data structure using virtual machine identifiers and label identifiers, each of the labels representing a distinct virtual machine parameter; associating, in a second data structure, a plurality of roles with a plurality of actions permitted to be performed with respect to the plurality of virtual machines; associating, by the host controller, a plurality of users with the plurality of roles and with the labels from the hierarchy of labels in a third data structure using user identifiers, role identifiers and the label identifiers, each of the plurality of roles defining at least one of the plurality of actions permitted to be performed with respect to the plurality of virtual machines; and upon receiving a request of a user of the plurality of users to perform an action with respect to a virtual machine of the plurality of virtual machines, determining, using the first data structure, one or more label identifiers associated with the virtual machine; determining, using the second data structure, one or more roles permitting the requested action; determining, using the third data structure, whether a user identifier of the user is associated with at least one of the determined label identifiers and at least one of the determined roles; and when the user identifier is associated with at least one of the determined label identifiers and at least one of the determined roles, determining that the user is permitted to perform the requested action with respect to the virtual machine.