Zone is a named space, for isolating profiler agents and UIs. You can think of the zone as a protected room, that needs a key (access token) to get into. Zone isolation means that profiler UI connected to one zone will not be able to connect to an agent in another zone.
Zones are plain, not hierarchical, and they cannot contain each other. You can create as many zones as you want, and create any number of access tokens for each zone.