In certain embodiments, a system determines to assign a computing resource to one or more users that are affiliated with an institution. The system pre-injects a first tag into a first portion of the computing resource and then assigns the computing resource to the one or more users. The first tag is associated with the institution and requires a first token to access the first portion of the computing resource. The system mid-process or post injects a second tag into a second portion of the computing resource. The second tag is associated with one of the users and requires a second token to access the second portion of the computing resource. The system controls access to the first and second portions of the computing resource based on whether subsequent requests to access the computing resource comprise the first token, the second token, or both.