A data processing apparatus comprising: processing circuitry configured to perform data processing operations in response to program instructions, said processing circuitry having a plurality of domains of operation having different secure levels, comprising a secure domain and a further different secure domain, wherein when operating in said secure domain said processing circuitry has access to at least some data that is not accessible in said further different secure domain; a data store for storing data and instructions, said data store comprising a plurality of regions each corresponding to one of said plurality of domains of operation, and comprising at least one secure region for storing sensitive data accessible by said data processing circuitry operating in said secure domain and not accessible by said data processing circuitry operating in said further different secure domain and a less secure region for storing less sensitive data; said processing circuitry being configured: to verify for a program instruction to be executed that a region of said data store storing said program instruction corresponds to a current domain of operation of said processing circuitry; and in response to detecting that said program instruction is stored in a region of said data store that does not correspond to said current domain of operation of said processing circuitry; to verify whether said program instruction comprises a guard instruction; and if said program instruction comprises said guard instruction to switch said domain of operation to a domain corresponding to said region of said data store storing said program instruction; and if said program instruction does not comprise said guard instruction to generate a security violation indication. processing circuitry configured to perform data processing operations in response to program instructions, said processing circuitry having a plurality of domains of operation having different secure levels, comprising a secure domain and a further different secure domain, wherein when operating in said secure domain said processing circuitry has access to at least some data that is not accessible in said further different secure domain; a data store for storing data and instructions, said data store comprising a plurality of regions each corresponding to one of said plurality of domains of operation, and comprising at least one secure region for storing sensitive data accessible by said data processing circuitry operating in said secure domain and not accessible by said data processing circuitry operating in said further different secure domain and a less secure region for storing less sensitive data; said processing circuitry being configured: to verify for a program instruction to be executed that a region of said data store storing said program instruction corresponds to a current domain of operation of said processing circuitry; and in response to detecting that said program instruction is stored in a region of said data store that does not correspond to said current domain of operation of said processing circuitry; to verify whether said program instruction comprises a guard instruction; and if said program instruction comprises said guard instruction to switch said domain of operation to a domain corresponding to said region of said data store storing said program instruction; and if said program instruction does not comprise said guard instruction to generate a security violation indication. to verify for a program instruction to be executed that a region of said data store storing said program instruction corresponds to a current domain of operation of said processing circuitry; and in response to detecting that said program instruction is stored in a region of said data store that does not correspond to said current domain of operation of said processing circuitry; to verify whether said program instruction comprises a guard instruction; and if said program instruction comprises said guard instruction to switch said domain of operation to a domain corresponding to said region of said data store storing said program instruction; and if said program instruction does not comprise said guard instruction to generate a security violation indication.