A computer-implemented method comprising: identifying a first instruction to create a variable handle instance, the first instruction including declaration information that identifies a type of a receiver and a variable held by the receiver to which the variable handle instance is configured to provide access, wherein the receiver is a structure used to hold the variable; responsive to the first instruction, and based on the declaration information, performing one or more checks to determine whether access to the variable is permissible, wherein the one or more checks is performed by at least determining whether an acting class issuing the first instruction has proper privileges to access the variable; in response to a determination that the acting class has the proper privileges to access the variable, creating the variable handle instance, the variable handle instance comprising one or more constrained functions configured to execute constrained operations on a memory location of the variable, wherein the one or more constrained functions comprise one or more of: one or more fenced operations or one or more atomic operations; identifying a second instruction that specifies a call to a particular constrained function of the one or more constrained functions of the variable handle instance, wherein the second instruction indicates the receiver; and identifying, based at least on the receiver indicated by the second instruction, a particular memory location where the variable is stored and causing performance of the particular constrained function with respect to the particular memory location. identifying a first instruction to create a variable handle instance, the first instruction including declaration information that identifies a type of a receiver and a variable held by the receiver to which the variable handle instance is configured to provide access, wherein the receiver is a structure used to hold the variable; responsive to the first instruction, and based on the declaration information, performing one or more checks to determine whether access to the variable is permissible, wherein the one or more checks is performed by at least determining whether an acting class issuing the first instruction has proper privileges to access the variable; in response to a determination that the acting class has the proper privileges to access the variable, creating the variable handle instance, the variable handle instance comprising one or more constrained functions configured to execute constrained operations on a memory location of the variable, wherein the one or more constrained functions comprise one or more of: one or more fenced operations or one or more atomic operations; identifying a second instruction that specifies a call to a particular constrained function of the one or more constrained functions of the variable handle instance, wherein the second instruction indicates the receiver; and identifying, based at least on the receiver indicated by the second instruction, a particular memory location where the variable is stored and causing performance of the particular constrained function with respect to the particular memory location. <EOS>