A method for preventing access to data and/or execution of code by code running in a different mode or privilege level comprising: separating addressable memory space into a plurality of chunks, the plurality of chunks respectively comprising a plurality of bits of the addressable memory space, and in which at least some of the chunks are associated with policy settings that identify one or more execution capabilities and one or more access capabilities of the plurality of chunks, and indicates whether code in the plurality of chunks are executable at a system privilege level or not, or whether data in the chunk is accessible as system mode data or not, and enforcing whether code execution or data access is allowed for a request from requesting code of a particular mode, in which the request indicates whether the request is to execute code or access data, the request is a requested address, including: addressing from the plurality of chunks, an addressed chunk based on the requested address, accessing the policy settings based upon the addressed chunk to determine the execution or data access capability associated with the addressed chunk, allowing or denying the request based upon the particular mode of the requesting code and the determined execution or data access capability associated with the addressed chunk, whether the request is to execute code or access data and the capability associated with the addressed chunk via a register or a page structure; and tracking a chunk boundary of each chunk relative to the addressable memory space and thereby determining the size of each chunk to reduce the addressable memory space used for the plurality of chunks. separating addressable memory space into a plurality of chunks, the plurality of chunks respectively comprising a plurality of bits of the addressable memory space, and in which at least some of the chunks are associated with policy settings that identify one or more execution capabilities and one or more access capabilities of the plurality of chunks, and indicates whether code in the plurality of chunks are executable at a system privilege level or not, or whether data in the chunk is accessible as system mode data or not, and enforcing whether code execution or data access is allowed for a request from requesting code of a particular mode, in which the request indicates whether the request is to execute code or access data, the request is a requested address, including: addressing from the plurality of chunks, an addressed chunk based on the requested address, accessing the policy settings based upon the addressed chunk to determine the execution or data access capability associated with the addressed chunk, allowing or denying the request based upon the particular mode of the requesting code and the determined execution or data access capability associated with the addressed chunk, whether the request is to execute code or access data and the capability associated with the addressed chunk via a register or a page structure; and tracking a chunk boundary of each chunk relative to the addressable memory space and thereby determining the size of each chunk to reduce the addressable memory space used for the plurality of chunks. addressing from the plurality of chunks, an addressed chunk based on the requested address, accessing the policy settings based upon the addressed chunk to determine the execution or data access capability associated with the addressed chunk, allowing or denying the request based upon the particular mode of the requesting code and the determined execution or data access capability associated with the addressed chunk, whether the request is to execute code or access data and the capability associated with the addressed chunk via a register or a page structure; and tracking a chunk boundary of each chunk relative to the addressable memory space and thereby determining the size of each chunk to reduce the addressable memory space used for the plurality of chunks.