A data center administrator is securing an ACI fabric that hosts a multi-tenant virtualized environment. Several VMs belonging to the same application EPG must be dynamically isolated based on their VM attributes (for example, VM name containing 'DB') without moving them to a different base EPG or requiring VLAN reassignment. The administrator wants endpoints matching the criteria to be classified into a separate policy group so that contracts can control communication between them and the rest of the EPG. Which ACI feature should be implemented to meet this requirement?