What mechanism prevents a program from accessing memory beyond its allocated space in base/bounds protection?