A low overhead, efficient, and simple protection check circuit is inserted into a data path between a master requester and a target resource such as a memory or input/output device. The master requester initiates a memory request, a pio access request, or a dma transaction directed to the target resource. For example, the master requester may be a processor accessing a memory, a processor performing programmed I/O (pio). Alternatively, the master requester may be a DMA device performing direct memory access of a memory. The protection check circuit is configured at initialization time by an operating system or a privileged software process, then passively monitors all transactions on the data paths, disallowing accesses that fail the protection check operation.