Address translation circuitry (16) translates a virtual address specified by a memory access request issued by requester circuitry into a target physical address (PA). Requester-side filtering circuitry (20) performs a granule protection lookup based on the target PA and a selected physical address space (PAS) associated with the memory access request, to determine whether to allow the memory access request to be passed to a cache or interconnect. In the granule protection lookup, the requester-side filtering circuitry obtains granule protection information corresponding to a target granule of physical addresses including the target PA, which indicates at least one allowed PAS associated with the target granule, and blocks the memory access request when the granule protection information indicates that the selected PAS is not an allowed PAS.