I want to contrast several distinctly different schemes to pass access to data between program modules which I call routines here. When RAM is not shared between the caller and routine, data must be included in a message to the routine, but this note is about those platforms where one can share RAM, by which I mean that the data need not be moved from one DRAM address to another.

Since computer memories were big enough to hold arrays, programs have passed addresses of those arrays in calls to subroutines in order for the routines to do special processing on the array. Another reason to pass the address was when the purpose of the routine was to modify the data.

Classic Compiled Languages
In this world the compiled code passes RAM address to and fro. Perhaps the compiler is clever enough to ensure that the code it compiles accesses only data to which it as received legitimate access. In C and many other languages the programmer can write code to wield illegitimate access to data.
Java
Java enforces its rules for accessing data.
Privileged code
In so far as a call is mediated by privileged code that is able to define the address spaces of the caller and routine, access to data can be passed, presumably at the behest of the caller, to the routine by modifying the routine’s address space to include the data. Doing this with hardware maps such as found on x68, PowerPC, SPARC 32b, 370, 390, is straight forward. It works well for a real cache. Only whole page sets are passable in this way. Keykos does this while sharing page tables as well as pages. How the caller asks for this and how the privileged code chooses the portion of the address space of the routine depends and many conflicting kernel design patterns.
mmap
Unix can share data across what it calls processes thru pipes, but that sends data which we are not considering here. Unix can also share data thru the mmap system call and then two or more processes share a portion of real RAM which appears in their respective address spaces. (Some versions of Unix do not show one process the results of another’s store until an msync call is made by the writer, and some, not even then.)
None of these provide for rescinding such access.