Abstract: Techniques are described herein for function-level limiting of privileges for a target application. Privileges dependencies for different functions of an application are determined based on static evaluation of the code base. A call graph with nodes representing the application functions is established, and the nodes are associated with the determined privilege dependencies. The graph is modified using iterative backward dataflow analysis to associate the nodes in the graph with privileges that are reachable from each node. Transition-edges are identified within the graph, where a transition-edge connects nodes having different sets of privileges. Function calls implementing the identified transition-edges are replaced, in instructions for the application (e.g., bytecode or machine code), with calls to wrapper functions.