An apparatus comprising: a trusted execution environment to configure a plurality of compartments (120A, 120B,..., 120N) in an address space of memory, each compartment (120A; 120B;...; 120N) comprising a private memory (122A; 122B;...; 122N) and a pointer to an object in a shared heap of the plurality of compartments (120A, 120B,..., 120N), wherein each compartment (120A; 120B;...; 120N) is isolated from other compartments (120A; 120B;...; 120N), is unable to access the private memory (122A; 120B;...; 120N) of other compartments (120A; 120B;...; 120N), and is unable to access any object in the shared heap that is solely assigned to another compartment (120A; 120B;...; 120N); decode circuitry to decode a single instruction into a decoded single instruction, the single instruction comprising a pointer for a first compartment to a first object in the shared heap; and execution circuitry to execute the decoded single instruction to generate an encoded capability, based at least in part on the pointer to the first object, to allow access to the first object in the shared heap by a second compartment in response to the second compartment having the encoded capability, wherein: the decode circuitry is to decode a second single instruction into a decoded second single instruction, the second single instruction comprising the encoded capability from the second compartment; and the execution circuitry is to execute the decoded second single instruction to check the encoded capability from the second compartment and, when the check passes, provide the pointer to the first object in the shared heap to the second compartment, and, when the check fails, does not provide the pointer to the first object in the shared heap to the second compartment, wherein: the second single instruction comprises an access size and the check comprises a check that an access at the pointer to the first object of the access size is within its authorized bounds, the check further comprising an authentication check, and the encoded capability includes a conveyed message authentication code, MAC, and the authentication check generates a regenerated MAC, and compares the conveyed MAC to the regenerated MAC. a trusted execution environment to configure a plurality of compartments (120A, 120B,..., 120N) in an address space of memory, each compartment (120A; 120B;...; 120N) comprising a private memory (122A; 122B;...; 122N) and a pointer to an object in a shared heap of the plurality of compartments (120A, 120B,..., 120N), wherein each compartment (120A; 120B;...; 120N) is isolated from other compartments (120A; 120B;...; 120N), is unable to access the private memory (122A; 120B;...; 120N) of other compartments (120A; 120B;...; 120N), and is unable to access any object in the shared heap that is solely assigned to another compartment (120A; 120B;...; 120N); decode circuitry to decode a single instruction into a decoded single instruction, the single instruction comprising a pointer for a first compartment to a first object in the shared heap; and execution circuitry to execute the decoded single instruction to generate an encoded capability, based at least in part on the pointer to the first object, to allow access to the first object in the shared heap by a second compartment in response to the second compartment having the encoded capability, wherein: the decode circuitry is to decode a second single instruction into a decoded second single instruction, the second single instruction comprising the encoded capability from the second compartment; and the execution circuitry is to execute the decoded second single instruction to check the encoded capability from the second compartment and, when the check passes, provide the pointer to the first object in the shared heap to the second compartment, and, when the check fails, does not provide the pointer to the first object in the shared heap to the second compartment, the decode circuitry is to decode a second single instruction into a decoded second single instruction, the second single instruction comprising the encoded capability from the second compartment; and the execution circuitry is to execute the decoded second single instruction to check the encoded capability from the second compartment and, when the check passes, provide the pointer to the first object in the shared heap to the second compartment, and, when the check fails, does not provide the pointer to the first object in the shared heap to the second compartment, wherein: the second single instruction comprises an access size and the check comprises a check that an access at the pointer to the first object of the access size is within its authorized bounds, the check further comprising an authentication check, and the encoded capability includes a conveyed message authentication code, MAC, and the authentication check generates a regenerated MAC, and compares the conveyed MAC to the regenerated MAC. the second single instruction comprises an access size and the check comprises a check that an access at the pointer to the first object of the access size is within its authorized bounds, the check further comprising an authentication check, and the encoded capability includes a conveyed message authentication code, MAC, and the authentication check generates a regenerated MAC, and compares the conveyed MAC to the regenerated MAC.