Efficient resource isolation remain critical challenges for RISC-V-based cloud computing, where workloads such as confidential virtual machines (CVMs) and containers face threats from unauthorized memory access, DMA attacks, and cross-privilege&cross-workload attacks. Existing hardware isolation mechanisms like Physical Memory Protection (PMP) suffer from static resource partitioning and inflexible dynamic configuration. This work presents Shield-XS, a lightweight workload isolation model for RISC-V. Shield-XS leverages a bitmap-based mechanism with a Shield-bit (1 bit per 4KB physical page) to dynamically mark and isolate sensitive and normal workloads. It implements hardware-enforced access control integrated into the Memory Manage Unit pipeline, with a dedicated Bitmap Cache to minimize performance overhead. It supports configurable one-way isolation, blocking unauthorized access from non-sensitive workloads to protected memory, I/O, and interrupt resources. Evaluated on a 7nm process, it introduces only 0.3% CPU hardware area overhead. SPEC06 benchmarking shows a mere 0.72% performance overhead. This work provides a flexible, low-overhead isolation solution for virtualization and containerization workloads within the RISC-V ecosystem.