A processor comprising: a compartment manager configured to: determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of memory, load a first compartment descriptor (160, 162) for the first compartment into one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, and check if the first compartment is marked in the first compartment descriptor (160, 162), within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, as a management compartment; a decoder, for a request from the first compartment marked as the management compartment, configured to decode a first instruction into a decoded first instruction; and an execution circuit configured to execute the decoded first instruction to load a second compartment descriptor for a second compartment of the memory from a location specified by a pointer in a compartment pointer register into the one or more registers (114, 116, 118, 120, 122, 124) of the processor core and set a compartment mode register of the processor core to an inside mode that causes a switch of execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allows speculative memory accesses for the second subset of code only within the second compartment, and prevents a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core. determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of memory, load a first compartment descriptor (160, 162) for the first compartment into one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, and check if the first compartment is marked in the first compartment descriptor (160, 162), within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, as a management compartment; a decoder, for a request from the first compartment marked as the management compartment, configured to decode a first instruction into a decoded first instruction; and an execution circuit configured to execute the decoded first instruction to load a second compartment descriptor for a second compartment of the memory from a location specified by a pointer in a compartment pointer register into the one or more registers (114, 116, 118, 120, 122, 124) of the processor core and set a compartment mode register of the processor core to an inside mode that causes a switch of execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allows speculative memory accesses for the second subset of code only within the second compartment, and prevents a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core.