A web service comprising: a host computing system having one or more processing cores and one or more memory subsystems (110, 150), the host computing system configured to execute computer-executable instructions of one or more isolation processes, isoprocs, wherein each isoproc has a separate interface to the operating system kernel through which each isoproc can request computation resources from the operating system, and wherein each isoproc's ability to communicate is limited to only associated defined communication channels (232, 242) over which it has express permission to communicate, and wherein each isoproc cannot communicate with or otherwise change the state of another isoproc outside of defined communication channels; a communication-channel regulator configured to selectively grant the one or more isoprocs one or more express permissions to communicate over a defined communication channel (232, 242), wherein an express permission granted by the communication-channel regulator defines communications properties of a defined communication channel of a subject isoproc, wherein the communication-channel regulator is part of the operating system kernel; a network service isoproc configured to handle communication between the subject isoproc and a communications network external to the host computing system; a web-service proxy isoproc configured to act as an intermediary between the subject isoproc and internal web-service isoprocs; wherein the separate interface of the subject isoproc to the operating system kernel allows the subject isoproc to control its own execution without affecting the execution of other isoprocs, the communications properties include type, rate, amount, and time of communication, and the only two defined communication channels to which the subject isoproc has express permission is a web request channel to the network service isoproc and a service request channel to the web-service proxy isoproc. a host computing system having one or more processing cores and one or more memory subsystems (110, 150), the host computing system configured to execute computer-executable instructions of one or more isolation processes, isoprocs, wherein each isoproc has a separate interface to the operating system kernel through which each isoproc can request computation resources from the operating system, and wherein each isoproc's ability to communicate is limited to only associated defined communication channels (232, 242) over which it has express permission to communicate, and wherein each isoproc cannot communicate with or otherwise change the state of another isoproc outside of defined communication channels; a communication-channel regulator configured to selectively grant the one or more isoprocs one or more express permissions to communicate over a defined communication channel (232, 242), wherein an express permission granted by the communication-channel regulator defines communications properties of a defined communication channel of a subject isoproc, wherein the communication-channel regulator is part of the operating system kernel; a network service isoproc configured to handle communication between the subject isoproc and a communications network external to the host computing system; a web-service proxy isoproc configured to act as an intermediary between the subject isoproc and internal web-service isoprocs; wherein the separate interface of the subject isoproc to the operating system kernel allows the subject isoproc to control its own execution without affecting the execution of other isoprocs, the communications properties include type, rate, amount, and time of communication, and the only two defined communication channels to which the subject isoproc has express permission is a web request channel to the network service isoproc and a service request channel to the web-service proxy isoproc.