A system comprising: execution logic comprising one or more execution units; memory comprising one or more memory units; and memory access logic for looking-up a mapping between a physical address space of the memory and a virtual address space; wherein the execution logic is arranged to run a plurality of software modules each in a respective partition of the physical address space, including to execute a memory access operation performed by a currently-executing one of said software modules, the memory access operation specifying a virtual address in the virtual address space as a target of the memory access operation; and the memory access logic is configured to perform operations of: looking-up a physical address in the physical address space mapped to the virtual address, checking whether a capability granting access to said physical address is found in a storage location to which the currently-executing software module has access, and on condition thereof, granting access to said physical address for performing said memory access operation; characterized in that: at least one of the capabilities comprises a respective split count value, and the execution unit is configured to perform: - a sharding operation whereby a capability is divided into at least two instances, and the division is recorded in the respective split count value of each instance; and - a shard recombination operation whereby the instances are recombined based on the respective split count values, and the reduction in the number of instances is recorded in the respective split count value of the recombined capability; wherein the execution logic is configured so as, based on the split count value, not to allow a capability to be divided more than a maximum predetermined number of times by instances of the sharding operation. execution logic comprising one or more execution units; memory comprising one or more memory units; and memory access logic for looking-up a mapping between a physical address space of the memory and a virtual address space; wherein the execution logic is arranged to run a plurality of software modules each in a respective partition of the physical address space, including to execute a memory access operation performed by a currently-executing one of said software modules, the memory access operation specifying a virtual address in the virtual address space as a target of the memory access operation; and the memory access logic is configured to perform operations of: looking-up a physical address in the physical address space mapped to the virtual address, checking whether a capability granting access to said physical address is found in a storage location to which the currently-executing software module has access, and on condition thereof, granting access to said physical address for performing said memory access operation; characterized in that: at least one of the capabilities comprises a respective split count value, and the execution unit is configured to perform: - a sharding operation whereby a capability is divided into at least two instances, and the division is recorded in the respective split count value of each instance; and - a shard recombination operation whereby the instances are recombined based on the respective split count values, and the reduction in the number of instances is recorded in the respective split count value of the recombined capability; wherein the execution logic is configured so as, based on the split count value, not to allow a capability to be divided more than a maximum predetermined number of times by instances of the sharding operation. at least one of the capabilities comprises a respective split count value, and the execution unit is configured to perform: - a sharding operation whereby a capability is divided into at least two instances, and the division is recorded in the respective split count value of each instance; and - a shard recombination operation whereby the instances are recombined based on the respective split count values, and the reduction in the number of instances is recorded in the respective split count value of the recombined capability; - a sharding operation whereby a capability is divided into at least two instances, and the division is recorded in the respective split count value of each instance; and - a shard recombination operation whereby the instances are recombined based on the respective split count values, and the reduction in the number of instances is recorded in the respective split count value of the recombined capability; wherein the execution logic is configured so as, based on the split count value, not to allow a capability to be divided more than a maximum predetermined number of times by instances of the sharding operation.