Shared space coordination models such as Linda are ill-suited for structuring applications composed of erroneous or insecure components. This paper presents the Secure Object Space model. In this model, a data element can be locked with a key and is only visible to a process that presents a matching key to unlock the element. We give a precise semantics for Secure Object Space operations and discuss an implementation in JAVA for a mobile agent system. An implementation of the semantics that employs encryption is also outlined for use in untrusted environments.