A membrane is the boundary of a regime inside of which the rules are changed somehow. Within the regime some systematic substitution is put in place and maintained unknown to the software inside but imposed and maintained by the software that creates the membrane. The software within the regime may be unaware of being in the regime. A membrane creates a virtualization of some sort; there are many sorts of virtualization. When a creator in Keykos is asked for a new instance the request must be accompanied by a reference to a bank from which to buy the material for the instance. If the creator is skeptical (most in Keykos are) because it wants to assure that the pages that it buys from the bak are not accessed except as it arranges, then it verifies that the proffered bank is legitimate by asking the bank transformer, “Is this here a real bank?”. The creator was born with access to the transformer. If we have access to the code that defines the behavior of the instances that the creator creates then we are in a position to run the code without such assurance.