1. A method comprising: identifying a first instruction to create a variable handle instance, the first instruction including declaration information that identifies a type of a receiver and a variable held by the receiver to which the variable handle instance is configured to provide access; responsive to the first instruction, and based on the declaration information, performing one or more checks to determine whether access to the variable is permissible; in response to a determination that access to the variable is permissible, creating the variable handle instance, the variable handle instance comprising one or more constrained functions configured to execute constrained operations on a memory location of the variable; identifying a second instruction that specifies a call to a particular constrained function of the one or more constrained functions of the variable handle instance, wherein the second instruction indicates the receiver; and identifying a particular memory location where the variable is stored and causing performance of the particular constrained function with respect to the particular memory location.