Is it sufficient to use a VM for isolation? Docker?

More cloud services now need role accounts. You need a "can read email but not send or forward" account, for example. And "can send only to this read-only contacts list".

It’s called Identity and Access Management, IAM.

Not sure I’ve ever seen an email provider with IAM for the accounts.