We present ribbons, a shared memory programming model that allows for more implicit sharing of memory than processes but is more restrictive than threads. Ribbons structure the heap into protection domains. Privileges between these protection domains are carefully controlled to provide the ability to fully or partially �sandbox� certain portions of a program�s computation. RibbonJ, a backwards-compatible extension of Java, is de?ned to easily create programs that leverage the ribbons model. RibbonJ is implemented within Jikes RVM, and avoids the overhead of inline security checks and read or write barriers by leveraging the memory protection mechanisms already supported in modern hardware and operating systems. This is joint work with Harrison Metzger and Professor Patrick Eugster.