A system comprises a memory and a processor that supports different privilege levels. Only program code executing at a certain privilege level is permitted to map memory and to assign access permission to the mapped memory, such as read-only, writable, and executable. Control code executing on the processor at that privilege level, in response to a request from other code executing at a different privilege level, maps a portion of memory for loading an executable file. After the executable file has been loaded into the mapped memory, the control code then verifies a signature associated with the executable file. If the signature is verified, the control code permits the executable file to be executed by the processor at a privilege level other than the one at which the control code executes. Otherwise, the control code prevents the executable file from being executed on the processor.