Embodiments herein describe a SoC with one or more untrusted islands that can host one or more roles or tenants in a data center environment (e.g., a cloud computing environment). In one embodiment, a secure shell encapsulates the untrusted islands with a secure application programming interface (API) to access other hardware resources in the SoC. Hardware resources in the SoC (e.g., HardIP, SoftIP, or both), can either be secure/trusted, or rely on the secure shell to ensure confidentiality.