An apparatus comprising: execution circuitry configured to execute a first one or more of instructions to establish a trusted domain using a trusted domain key, the trusted domain key to be used to encrypt memory pages of the trusted domain, and the execution circuitry configured to execute a second one or more of the instructions to add a first memory page to the trusted domain, wherein the first memory page is private to the trusted domain and a first set of page attributes is set for the first memory page based on the second one or more of the instructions, and wherein the first set of page attributes indicates how the first memory page is mapped in a secure extended page table, SEPT, wherein the secure extended page table, SEPT, is to translate guest physical addresses, GPA, to host physical addresses, HPA, and a storage location configured to store the first set of page attributes for the first memory page in the secure extended page table, SEPT, responsive to executing the second one or more of the instructions; wherein the execution circuitry is configured to execute a third one or more of the instructions to augment a second memory page to the trusted domain, wherein the second memory page is private to the trusted domain; characterized in that wherein the execution circuitry is configured to execute a fourth one or more of the instructions to accept augmenting the second memory page for the trusted domain, wherein the fourth one or more of the instructions is to set a second set of page attributes for the second memory page, and wherein the second set of page attributes indicates how the second memory page is mapped in the secure extended page table, SEPT. execution circuitry configured to execute a first one or more of instructions to establish a trusted domain using a trusted domain key, the trusted domain key to be used to encrypt memory pages of the trusted domain, and the execution circuitry configured to execute a second one or more of the instructions to add a first memory page to the trusted domain, wherein the first memory page is private to the trusted domain and a first set of page attributes is set for the first memory page based on the second one or more of the instructions, and wherein the first set of page attributes indicates how the first memory page is mapped in a secure extended page table, SEPT, wherein the secure extended page table, SEPT, is to translate guest physical addresses, GPA, to host physical addresses, HPA, and a storage location configured to store the first set of page attributes for the first memory page in the secure extended page table, SEPT, responsive to executing the second one or more of the instructions; wherein the execution circuitry is configured to execute a third one or more of the instructions to augment a second memory page to the trusted domain, wherein the second memory page is private to the trusted domain; characterized in that wherein the execution circuitry is configured to execute a fourth one or more of the instructions to accept augmenting the second memory page for the trusted domain, wherein the fourth one or more of the instructions is to set a second set of page attributes for the second memory page, and wherein the second set of page attributes indicates how the second memory page is mapped in the secure extended page table, SEPT.