memory protection
Imagine each room in the building carries a small sign: 'readable by all, but only the owner may rearrange it' or 'staff only — no tenants.' Before anyone touches a room, the guard checks the sign and turns them away if they lack the right. Memory protection is exactly this: the hardware checks, on every access, whether the running code is allowed to read, write, or execute the targeted page, and blocks it if not.
Concretely, protection rides along with translation. Each page-table entry carries permission bits — typically separate flags for read, write, and execute, plus a user/supervisor flag saying whether ordinary user-mode code may touch the page at all. On each access the MMU checks the requested operation against these bits: writing a read-only page, executing a no-execute page, or a user program touching a supervisor-only page all raise a protection fault that traps to the OS (which usually terminates the offending program). Because permissions are per-page, the same machinery that translates also polices, at no extra lookup.
Why it matters: memory protection is what turns 'each program has its own address space' from a mere convenience into a security guarantee. It prevents one process from reading or corrupting another's memory, stops a program from overwriting its own code, and underlies the entire user/kernel boundary that keeps applications from trampling the operating system. Marking pages no-execute (so injected data cannot run as code) and read-only (so constants and code cannot be altered) are concrete defenses built directly on these bits. Protection is not a separate subsystem bolted on — it is woven into address translation itself.
A buffer overflow tries to write past an array into a read-only code page. The MMU sees the write bit is clear for that page, raises a protection fault, and the OS kills the program — a corruption stopped at the hardware boundary.
Per-page permission bits, checked by the MMU on every access, are the wall between programs.
Protection and translation share the same page table and the same lookup — they are not two separate passes. This is why hardware-enforced isolation is essentially free per access, but also why it depends entirely on the OS setting the permission bits correctly.