1. A method of controlling access to one or more resources in accordance with a policy, the method comprising: defining an invariant condition constraining one or more resources that can be identified using a virtual address, the invariant condition being defined such that a set of physical addresses that a source can address through an address translation mechanism using a virtual address and a set of resources to which access by the source is unallowable by the policy are distinct and non-intersecting; receiving a request to allow a requesting source to access one of the resources; determining whether the request identifies a resource using a virtual address or using a physical address; if the request identifies the resource using a virtual address, then allowing the request without evaluating whether the request violates the policy; if the request identifies the resource using a physical address, then determining whether the physical address is a member of a set of physical addresses to which the policy blocks access; if the physical address is a member of the set of physical addresses to which the policy blocks access, then blocking the request; and if the physical address is not a member of the set of physical addresses to which the policy blocks access, then allowing the request.