export-controlled workload environments