A computer-implemented method, comprising: obtaining, by a secure interface control in a computing system, wherein the secure interface control is communicatively coupled to a hypervisor, wherein the hypervisor manages one or more guests, metadata linked to an image of a secure guest of an owner and managed by the hypervisor, wherein the metadata comprises one or more controls, wherein each control of the one or more controls indicates to the secure interface control whether the hypervisor is permitted to execute an instance of a secure guest generated with the image in the computing system based on a presence or absence of one or more system settings in the computing system; intercepting, by the secure interface control, a command by the hypervisor to initiate the instance of the secure guest from the image of the secure guest; determining, by the secure interface control, the presence or the absence of the one or more system settings in the computing system; determining, by the secure interface control, based on the one or more controls and the presence or the absence of the one or more system settings, if the hypervisor is permitted to execute the instance; based on determining that the hypervisor is permitted to execute the instance; enabling, by the secure interface control, initiation of the instance by the hypervisor, in the computing system, based on relaying the intercepted command to the hypervisor, monitoring, by the secure interface control, during runtime of the instance initiated by the hypervisor responsive to the enabling, the one or more system settings_, determining, by the secure interface control, that at least one setting of the one or more system settings changed during the runtime; identifying, by the secure interface control, in the metadata, a given control of the one or more controls relevant to the at least one setting that changed during the runtime; determining, by the secure interface control, based on the at least one setting that changed during the runtime and the given control, if the hypervisor is no longer permitted to execute the instance; and based on determining that the hypervisor is no longer permitted to execute the instance, causing, by the secure interface control, during the runtime of the instance, the hypervisor to terminate the instance; and based on determining that the hypervisor is not permitted to execute the instance; ignoring, by the secure interface control, the command. obtaining, by a secure interface control in a computing system, wherein the secure interface control is communicatively coupled to a hypervisor, wherein the hypervisor manages one or more guests, metadata linked to an image of a secure guest of an owner and managed by the hypervisor, wherein the metadata comprises one or more controls, wherein each control of the one or more controls indicates to the secure interface control whether the hypervisor is permitted to execute an instance of a secure guest generated with the image in the computing system based on a presence or absence of one or more system settings in the computing system; intercepting, by the secure interface control, a command by the hypervisor to initiate the instance of the secure guest from the image of the secure guest; determining, by the secure interface control, the presence or the absence of the one or more system settings in the computing system; determining, by the secure interface control, based on the one or more controls and the presence or the absence of the one or more system settings, if the hypervisor is permitted to execute the instance; based on determining that the hypervisor is permitted to execute the instance; enabling, by the secure interface control, initiation of the instance by the hypervisor, in the computing system, based on relaying the intercepted command to the hypervisor, monitoring, by the secure interface control, during runtime of the instance initiated by the hypervisor responsive to the enabling, the one or more system settings_, determining, by the secure interface control, that at least one setting of the one or more system settings changed during the runtime; identifying, by the secure interface control, in the metadata, a given control of the one or more controls relevant to the at least one setting that changed during the runtime; determining, by the secure interface control, based on the at least one setting that changed during the runtime and the given control, if the hypervisor is no longer permitted to execute the instance; and based on determining that the hypervisor is no longer permitted to execute the instance, causing, by the secure interface control, during the runtime of the instance, the hypervisor to terminate the instance; and determining, by the secure interface control, that at least one setting of the one or more system settings changed during the runtime; identifying, by the secure interface control, in the metadata, a given control of the one or more controls relevant to the at least one setting that changed during the runtime; determining, by the secure interface control, based on the at least one setting that changed during the runtime and the given control, if the hypervisor is no longer permitted to execute the instance; and based on determining that the hypervisor is no longer permitted to execute the instance, causing, by the secure interface control, during the runtime of the instance, the hypervisor to terminate the instance; and based on determining that the hypervisor is not permitted to execute the instance; ignoring, by the secure interface control, the command.