A hardware processor comprising: a decoder to decode instructions into decoded instructions; an execution circuit to execute the decoded instructions to generate one or more memory accesses to memory; and a compartment manager circuit configured to: determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of the memory, load a first compartment descriptor (160, 162) for the first compartment into one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, check if the first compartment is marked in the first compartment descriptor (160, 162), within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, as a management compartment, and when the first compartment is marked in the first compartment descriptor (160, 162) as the management compartment, allow the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, switch execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allow speculative memory accesses for the second subset of code only within the second compartment, and prevent a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, wherein the second compartment, as indicated by the second compartment descriptor, comprises a plurality of non-continuous slices in a single address space in the memory. a decoder to decode instructions into decoded instructions; an execution circuit to execute the decoded instructions to generate one or more memory accesses to memory; and a compartment manager circuit configured to: determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of the memory, load a first compartment descriptor (160, 162) for the first compartment into one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, check if the first compartment is marked in the first compartment descriptor (160, 162), within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, as a management compartment, and when the first compartment is marked in the first compartment descriptor (160, 162) as the management compartment, allow the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, switch execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allow speculative memory accesses for the second subset of code only within the second compartment, and prevent a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, wherein the second compartment, as indicated by the second compartment descriptor, comprises a plurality of non-continuous slices in a single address space in the memory. determine, when a compartment control register of a processor core is set to an enable value, that a first subset of code requested for execution on the processor core in user privilege is within a first compartment of the memory, load a first compartment descriptor (160, 162) for the first compartment into one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, check if the first compartment is marked in the first compartment descriptor (160, 162), within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, as a management compartment, and when the first compartment is marked in the first compartment descriptor (160, 162) as the management compartment, allow the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers (114, 116, 118, 120, 122, 124) of the processor core from the memory, switch execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allow speculative memory accesses for the second subset of code only within the second compartment, and prevent a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers (114, 116, 118, 120, 122, 124) of the processor core, wherein the second compartment, as indicated by the second compartment descriptor, comprises a plurality of non-continuous slices in a single address space in the memory.