A computer system, comprising: a memory; a processor coupled with the memory to execute instructions, stored in the memory, of routines that are classified in a predefined set of domains (101, 103,..., 105); and a memory management unit coupled between the processor and the memory, wherein the memory management unit is configured to manage a page table containing a page table entry; the computer system further comprising: a shadow cache structure having a first call stack and a second call stack; wherein the page table entry includes a security setting (111, 113,..., 115) for each of the domains (101, 103,..., 105) in the predefined set; wherein the memory management unit is configured to map a virtual memory address to a physical memory address using the page table entry during a call of a first routine in a first domain to a second routine at the virtual memory address; wherein the memory management unit is further configured to extract a first security setting from the page table entry based on the first domain; wherein the computer system is configured to selectively implement a security operation for the call based at least in part on a value of the first security setting retrieved from the page table entry; and wherein the processor is configured to, in response to the call and based on the value of the first security setting being equal to a predetermined value requiring a sandboxing operation, perform the sandboxing operation as the security operation to: execute the first routine using the first call stack and prevent execution of the first routine from accessing the second call stack; and execute the second routine using the second call stack. a memory; a processor coupled with the memory to execute instructions, stored in the memory, of routines that are classified in a predefined set of domains (101, 103,..., 105); and a memory management unit coupled between the processor and the memory, wherein the memory management unit is configured to manage a page table containing a page table entry; the computer system further comprising: a shadow cache structure having a first call stack and a second call stack; wherein the page table entry includes a security setting (111, 113,..., 115) for each of the domains (101, 103,..., 105) in the predefined set; wherein the memory management unit is configured to map a virtual memory address to a physical memory address using the page table entry during a call of a first routine in a first domain to a second routine at the virtual memory address; wherein the memory management unit is further configured to extract a first security setting from the page table entry based on the first domain; wherein the computer system is configured to selectively implement a security operation for the call based at least in part on a value of the first security setting retrieved from the page table entry; and wherein the processor is configured to, in response to the call and based on the value of the first security setting being equal to a predetermined value requiring a sandboxing operation, perform the sandboxing operation as the security operation to: execute the first routine using the first call stack and prevent execution of the first routine from accessing the second call stack; and execute the second routine using the second call stack. execute the first routine using the first call stack and prevent execution of the first routine from accessing the second call stack; and execute the second routine using the second call stack.