1. A method comprising: identifying a network location of an endpoint, which is attempting to initiate an application; identifying, based at least in part on the network location of the endpoint, whether the endpoint is operating in an enterprise environment; determining whether the application is trusted based on metadata associated with the application, wherein the determining comprises: transmitting a hash of the application to an application database, and receiving, from the application database, a policy designating how data traffic associated with the application is to be routed in a network based on the hash of the application; provisioning, based on the policy, a tunnel for the data traffic associated with the application if the application is not trusted, and the endpoint is operating within the enterprise environment, wherein the data traffic associated with the application is tunneled to an enterprise edge for access to the Internet and the application is isolated from accessing enterprise data in the enterprise environment, wherein packets of the data traffic are tagged with the metadata, the metadata comprising a user identifier corresponding to the application on a per endpoint basis, and wherein the provisioning comprises routing the packets over the tunnel at a socket level based on the user identifier in the metadata; and not provisioning, based on the policy, the tunnel for the data traffic associated with the application if the application is trusted, and the endpoint is operating within the enterprise environment, wherein a first subset of the data traffic associated with the application is generated by a plugin loaded by the application, and subsequently provisioning the tunnel only for the first subset based on whether a combination of the application and the plugin is trusted.