Abstract: A permission vector comprising a plurality of permission sets is used to manage permissions to resources of a resource provider. Each of the plurality of permission sets may correspond to a different resource of the resource provider, wherein each resource of the resource provider has an orthogonal relationship to the other resources. Each permission set may include one or more permission elements that define permissions granted to a user for accessing a corresponding resource element of a resource. The permission vector may be used to determine whether to fulfill user requests submitted to the resource provider to perform an operation that includes accessing a set of requested resources.

Abstract: Disclosed are various embodiments for automated determination of application privileges. An application testing service executes an application in a testing computing environment that replicates a production computing environment. The application is given a set of permissions in the testing computing environment. A set of use cases for the application is performed while the application is executing in the testing computing environment. A set of operations invoked by the application to perform the set of use cases is determined. A subset of the set of permissions is generated that corresponds to a minimal set of permissions necessary to invoke the set of operations.