An access control determination service automatically determines and/or revises an access control policy using actions attempted by a client system. A client is observed during operation. A policy system analyzes the actions performed and/or results of the actions performed by a client system. Using the results of the analysis, the access control determination service determines the permissions needed in an access control policy that will be applied to the client.