An apparatus comprising: processing circuitry configured to perform data processing in response to one or more software processes; and memory access circuitry (20, 22, 24) configured to control access to a plurality of memory regions based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region; and a realm management unit (20, 22, 24) configured to control operation of a given realm based on security configuration parameters associated with the given realm; in which: on activation of a target realm to enable the target realm to be processed by the processing circuitry, the realm management unit is configured to: detect whether a parameter signature derived from the security configuration parameters set for the target realm by a parent realm in response to a request to create the target realm matches an expected signature provided to the parent realm in the request to create the target realm; and in response to detecting a mismatch between the parameter signature and the expected signature, apply an activation restriction to the target realm to: prevent the activation of the target realm; or prevent access by the target realm to at least one of: at least one secret key for protecting data associated with the target realm; and key material for deriving said at least one secret key. processing circuitry configured to perform data processing in response to one or more software processes; and memory access circuitry (20, 22, 24) configured to control access to a plurality of memory regions based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region; and a realm management unit (20, 22, 24) configured to control operation of a given realm based on security configuration parameters associated with the given realm; in which: on activation of a target realm to enable the target realm to be processed by the processing circuitry, the realm management unit is configured to: detect whether a parameter signature derived from the security configuration parameters set for the target realm by a parent realm in response to a request to create the target realm matches an expected signature provided to the parent realm in the request to create the target realm; and in response to detecting a mismatch between the parameter signature and the expected signature, apply an activation restriction to the target realm to: prevent the activation of the target realm; or prevent access by the target realm to at least one of: at least one secret key for protecting data associated with the target realm; and key material for deriving said at least one secret key. detect whether a parameter signature derived from the security configuration parameters set for the target realm by a parent realm in response to a request to create the target realm matches an expected signature provided to the parent realm in the request to create the target realm; and in response to detecting a mismatch between the parameter signature and the expected signature, apply an activation restriction to the target realm to: prevent the activation of the target realm; or prevent access by the target realm to at least one of: at least one secret key for protecting data associated with the target realm; and key material for deriving said at least one secret key. prevent the activation of the target realm; or prevent access by the target realm to at least one of: at least one secret key for protecting data associated with the target realm; and key material for deriving said at least one secret key. at least one secret key for protecting data associated with the target realm; and key material for deriving said at least one secret key.