A kernel receives a request to execute a first process instance from an agent. The first process instance is an instance of a first program. The kernel obtains one or more access control rules related to the agent. The kernel permits execution of the first process instances based on the access control rules. The kernel detects the first process instance attempting to access a second process instance during execution of the first process instance. The second process instance is an instance of a second program currently being executed. The kernel determines whether to grant the first process instance permission to access the second process instances based on the access control rules.