More important, this abstraction separates different Organizations from each other. Even if they happen to be assigned common networks, datastores, or resource pools, they cannot modify or even see each other’s vApps without explicitly sharing them. (The exception is vApps connected to the same External Network, as they’re sharing the same vSwitch.) Providing Organizations with unique datastores, networks, and resource pools enforces even greater separation between the Organizations through the quotas you can set in those abstractions. The VMware vCloud Director layer also provides the ability to leverage vShield for network address translation (NAT) and firewalling of networks. This.
