A system comprising a memory and a trusted execution environment, TEE,, the TEE being configured to: configure a plurality of compartments (120A, 120B,..., 120N) in an address space of the memory, each compartment (120A, 120B,..., 120N) comprising a private memory (122A, 122B,..., 122N) and a pointer to a message block in a shared heap; receive a request to send a message from a first compartment, the request comprising the pointer for the first compartment to the corresponding message block in the shared heap and a destination compartment; respond to the request by authenticating the request, generating a corresponding encoded capability, conveying the encoded capability to the destination compartment, and scheduling the destination compartment to respond to the request; and subsequently, receive and respond to a check capability request from the destination compartment by checking the encoded capability and, when the check passes, providing a memory address to access the message block, and, otherwise, generating a fault; wherein each compartment is isolated from other compartments, is unable to access private memory regions of other compartments, and is unable to access any message objects in the shared heap that are assigned to other compartments, wherein the TEE is further configured to authenticate the request received from the first compartment by assuring that the pointer to the message block is bounded within a heap address range assigned to the first compartment, and wherein the conveyed encoded capability includes a message authentication code, MAC, and the TEE is further configured to, when responding to the check capability request, regenerate the MAC and compare the conveyed MAC to the regenerated MAC. configure a plurality of compartments (120A, 120B,..., 120N) in an address space of the memory, each compartment (120A, 120B,..., 120N) comprising a private memory (122A, 122B,..., 122N) and a pointer to a message block in a shared heap; receive a request to send a message from a first compartment, the request comprising the pointer for the first compartment to the corresponding message block in the shared heap and a destination compartment; respond to the request by authenticating the request, generating a corresponding encoded capability, conveying the encoded capability to the destination compartment, and scheduling the destination compartment to respond to the request; and subsequently, receive and respond to a check capability request from the destination compartment by checking the encoded capability and, when the check passes, providing a memory address to access the message block, and, otherwise, generating a fault; wherein each compartment is isolated from other compartments, is unable to access private memory regions of other compartments, and is unable to access any message objects in the shared heap that are assigned to other compartments, wherein the TEE is further configured to authenticate the request received from the first compartment by assuring that the pointer to the message block is bounded within a heap address range assigned to the first compartment, and wherein the conveyed encoded capability includes a message authentication code, MAC, and the TEE is further configured to, when responding to the check capability request, regenerate the MAC and compare the conveyed MAC to the regenerated MAC.