Abstract: A computer operating system in which transfer of control of executing threads between protection domains is implemented using specific portals dedicated to the particular transfer of control between two protection domains. The transfer of control may also include parameter manipulation. A server registers a portal specification with a portal manager, the portal specification defining the behavior of portals which transfer control to the server. Thereafter, when a client application desires service from the server, the client application requests instantiation of a portal which will transfer control of an execution thread from the client application protection domain to the server protection domain. Upon receipt of the request, the portal manager dynamically generates portal code and updates a portal table associated with the client application, thus instantiating the portal.