AWS introduced the Nitro Isolation Engine on its new M9g and M9gd Graviton5 instances and used Isabelle/HOL to prove that it enforces strict VM isolation. They modeled the engine in a subset of Rust (μRust), wrote Separation Logic specifications, and proved functional correctness, memory safety, and noninterference to guarantee confidentiality and integrity.