Isn't this somewhat achievable already with cloud hosted vms, like AWS workspaces? IAM rules, SSO, etc, gets you a long way there I would imagine?