An apparatus comprising: processing circuitry to perform data processing in response to one or more software processes; and memory access circuitry to control access to a plurality of memory regions of a memory address space based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region; and a realm management unit to control operation of a given realm based on security configuration parameters associated with the given realm; characterised in that: when the security configuration parameters for the given realm specify that the given realm is associated with a trusted intermediary realm identified by the security configuration parameters, the realm management unit is configured to permit the trusted intermediary realm to perform at least one realm management function for the given realm; each realm other than a root realm is associated with a corresponding parent realm which created the realm; and the realm management unit is configured to support the security configuration parameters defining the trusted intermediary realm as a realm other than the parent realm of the given realm. processing circuitry to perform data processing in response to one or more software processes; and memory access circuitry to control access to a plurality of memory regions of a memory address space based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region; and a realm management unit to control operation of a given realm based on security configuration parameters associated with the given realm; characterised in that: when the security configuration parameters for the given realm specify that the given realm is associated with a trusted intermediary realm identified by the security configuration parameters, the realm management unit is configured to permit the trusted intermediary realm to perform at least one realm management function for the given realm; each realm other than a root realm is associated with a corresponding parent realm which created the realm; and the realm management unit is configured to support the security configuration parameters defining the trusted intermediary realm as a realm other than the parent realm of the given realm. when the security configuration parameters for the given realm specify that the given realm is associated with a trusted intermediary realm identified by the security configuration parameters, the realm management unit is configured to permit the trusted intermediary realm to perform at least one realm management function for the given realm; each realm other than a root realm is associated with a corresponding parent realm which created the realm; and the realm management unit is configured to support the security configuration parameters defining the trusted intermediary realm as a realm other than the parent realm of the given realm.