Secure distributed execution of jobs

A system comprises several processing units 211-214 and a controller 232 connected by an interconnect 230. Each processing unit enters a trusted mode and selects a job to be executed from a queue 250. It then reads access control metadata for the job from a data store 244. The unit then enters an untrusted mode to execute the job, using the access control metadata to control access by the job to shared data. When the job is complete, the processing unit is reset, and the process is repeated. The trusted mode may be entered when the processing unit is rebooted. The processing unit may update the information in the queue at the end of the job. This may be after the processing unit is reset. It may include assigning a job to another processing unit. The processing units may be arranged in clusters 201-208. There may be multiple queues accessed via a pointer store 240.