Safe programming languages encourage the development of dynamically extensible systems, such as extensible Web servers and mobile agent platforms. Although protection is of utmost importance in these settings, current solutions do not adequately address fault containment. This paper advocates an approach to protection where transactions act as protection domains. This enables direct sharing of objects while protecting against unauthorized accesses and failures of authorized components. The main questions about this approach are what transaction models translate best into protection mechanisms suited for extensible language-based systems and what is the impact of transaction-based protection on performance. A programmable isolation engine has been integrated with the runtime of a safe programming language in order to allow quick experimentation with a variety of isolation models and to answer both questions. This paper reports on the techniques for flexible finegrained locking and undo...