In FreeMiNT (ok, I'm from the other side of the fence, sorry), it's possible to specify the level of protection for each process through dedicated flags in the program header. In practice, this means that you can flag two apps as belonging to "global" memory, causing them to share the same address space. These two applications can then access eachothers memory freely. (Ok, it's not considered perfectly clean, but it provides some degree of compatibility for older applications). Well behaved applications can run as "private", and their memory can't be touched nor can they touch other memory belonging to other processes.
Couldn't this approach be used in AmigaOS as well?