diff --git a/src/lib.rs b/src/lib.rs
index 6592011..4b9f26b 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -14,10 +14,13 @@
 // do anything - all the magic is handled entirely by
 // autocxx_macro::include_cpp_impl.
 
+mod reference_wrapper;
 mod rvalue_param;
 pub mod subclass;
 mod value_param;
 
+pub use reference_wrapper::{CppMutRef, CppPin, CppRef};
+
 #[cfg_attr(doc, aquamarine::aquamarine)]
 /// Include some C++ headers in your Rust project.
 ///
@@ -257,6 +260,14 @@
 ///
 /// Generated C++ APIs which use raw pointers remain `unsafe`
 /// no matter what policy you choose.
+///
+/// There's an additional possible experimental safety
+/// policy available here:
+/// `safety!(unsafe_references_wrapped)`
+/// This policy treats C++ references as scary and requires
+/// them to be wrapped in a `CppRef` type. This `CppRef`
+/// type is implemented within the generated bindings but
+/// follows the contract of [`CppRef`].
 #[macro_export]
 macro_rules! safety {
     ($($tt:tt)*) => { $crate::usage!{$($tt)*} };
@@ -613,6 +624,9 @@
     pub use crate::c_void;
     pub use crate::cpp_semantics;
     pub use crate::include_cpp;
+    pub use crate::CppMutRef;
+    pub use crate::CppPin;
+    pub use crate::CppRef;
     pub use crate::PinMut;
     pub use crate::RValueParam;
     pub use crate::ValueParam;
diff --git a/src/reference_wrapper.rs b/src/reference_wrapper.rs
new file mode 100644
index 0000000..ed943d3
--- /dev/null
+++ b/src/reference_wrapper.rs
@@ -0,0 +1,109 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+// https://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or https://opensource.org/licenses/MIT>, at your
+// option. This file may not be copied, modified, or distributed
+// except according to those terms.
+
+/// A C++ const reference. These are different from Rust's `&T` in that
+/// these may exist even while the object is mutated elsewhere.
+///
+/// This is a trait not a struct due to the nuances of Rust's orphan rule
+/// - implemntations of this trait are found in each set of generated bindings
+/// but they are essentially the same.
+pub trait CppRef<'a, T> {
+    /// Retrieve the underlying C++ pointer.
+    fn as_ptr(&self) -> *const T;
+
+    /// Get a regular Rust reference out of this C++ reference.
+    ///
+    /// # Safety
+    ///
+    /// Callers must guarantee that the referent is not modified by any other
+    /// C++ or Rust code while the returned reference exists. Callers must
+    /// also guarantee that no mutable Rust reference is created to the
+    /// referent while the returned reference exists.
+    unsafe fn as_ref(&self) -> &T {
+        &*self.as_ptr()
+    }
+}
+
+/// A C++ non-const reference. These are different from Rust's `&mut T` in that
+/// several C++ references can exist to the same underlying data ("aliasing")
+/// and that's not permitted in Rust.
+///
+/// This is a trait not a struct due to the nuances of Rust's orphan rule
+/// - implemntations of this trait are found in each set of generated bindings
+/// but they are essentially the same.
+pub trait CppMutRef<'a, T>: CppRef<'a, T> {
+    /// Retrieve the underlying C++ pointer.
+    fn as_mut_ptr(&self) -> *mut T;
+
+    /// Get a regular Rust mutable reference out of this C++ reference.
+    ///
+    /// # Safety
+    ///
+    /// Callers must guarantee that the referent is not modified by any other
+    /// C++ or Rust code while the returned reference exists. Callers must
+    /// also guarantee that no other Rust reference is created to the referent
+    /// while the returned reference exists.
+    unsafe fn as_mut(&mut self) -> &mut T {
+        &mut *self.as_mut_ptr()
+    }
+}
+
+/// Any newtype wrapper which causes the contained object to obey C++ reference
+/// semantics rather than Rust reference semantics.
+///
+/// The complex generics here are working around the orphan rule - the only
+/// important generic is `T` which is the underlying stored type.
+///
+/// C++ references are permitted to alias one another, and commonly do.
+/// Rust references must alias according only to the narrow rules of the
+/// borrow checker.
+///
+/// If you need C++ to access your Rust object, first imprison it in one of these
+/// objects, then use [`Self::as_cpp_ref`] to obtain C++ references to it.
+pub trait CppPin<'a, T: 'a> {
+    /// The type of C++ reference created to the contained object.
+    type CppRef: CppRef<'a, T>;
+
+    /// The type of C++ mutable reference created to the contained object..
+    type CppMutRef: CppMutRef<'a, T>;
+
+    /// Get an immutable pointer to the underlying object.
+    fn as_ptr(&self) -> *const T;
+
+    /// Get a mutable pointer to the underlying object.
+    fn as_mut_ptr(&mut self) -> *mut T;
+
+    /// Returns a reference which obeys C++ reference semantics
+    fn as_cpp_ref(&self) -> Self::CppRef;
+
+    /// Returns a mutable reference which obeys C++ reference semantics.
+    ///
+    /// Note that this requires unique ownership of `self`, but this is
+    /// advisory since the resulting reference can be cloned.
+    fn as_cpp_mut_ref(&mut self) -> Self::CppMutRef;
+
+    /// Get a normal Rust reference to the underlying object. This is unsafe.
+    ///
+    /// # Safety
+    ///
+    /// You must guarantee that C++ will not mutate the object while the
+    /// reference exists.
+    unsafe fn as_ref(&self) -> &T {
+        &*self.as_ptr()
+    }
+
+    /// Get a normal Rust mutable reference to the underlying object. This is unsafe.
+    ///
+    /// # Safety
+    ///
+    /// You must guarantee that C++ will not mutate the object while the
+    /// reference exists.
+    unsafe fn as_mut(&mut self) -> &mut T {
+        &mut *self.as_mut_ptr()
+    }
+}
diff --git a/src/subclass.rs b/src/subclass.rs
index d2827ca..6c6ee31 100644
--- a/src/subclass.rs
+++ b/src/subclass.rs
@@ -207,8 +207,9 @@
 /// * You _may_ need to implement [`CppPeerConstructor`] for your subclass,
 ///   but only if autocxx determines that there are multiple possible superclass
 ///   constructors so you need to call one explicitly (or if there's a single
-///   non-trivial superclass constructor.) autocxx will implemente this trait
-///   for you if there's no ambiguity.
+///   non-trivial superclass constructor.) autocxx will implement this trait
+///   for you if there's no ambiguity and FFI functions are safe to call due to
+///   `autocxx::safety!` being used.
 ///
 /// # How to access your Rust structure from outside
 ///