The paper describes ACOM (Access Control Monitor), a hardware device which we developed to enforce run time protection in an persistent object-oriented system. To obtain a wide acceptance, the efSiciency of these systems must be comparable to conventional language systems. One of the key issues is to exploit the efJiciency of virtual memory management of contemporary processors. We will argue that a careful analysis of the hardware-software trade-ofl will lead to a simple hardware device which can efliciently support encapsulation and protection of small objects in an object-oriented systems. The main idea is to separate encapsulation and protection from address translation issues.