Much experience has been gained with the protocols and mechanisms needed for discovery and allocation of remote computational resources. However, the preparation of a remote computer for use by a distributed application also requires the creation of an appropriate execution environment, which remains an ad hoc and often clumsy process. We propose here a codification of the interactions required to negotiate the creation of new execution environments. In brief, we model dynamic virtual environments (DVEs) as first-class entities in a distributed environment, with Grid service interfaces defined to negotiate creation, monitor properties, and manage lifetime. We also show how such DVEs can be implemented in a variety of technologiessandboxes, virtual machines, or simply Unix accounts-and evaluate costs associated with these different approaches. DVEs provide a basis for both customization of a remote computer to meet user needs and also enforcement of resource usage and security policies. They can also simplify the administration of virtual organizations (VOs), by allowing new environments to be created automatically, subject to local and VO policy. Thus, DVEs have the potential to relieve much of the current administrative burden involved in providing and using Grid resources.