Providing access control for an application is disclosed. An application is monitored. An application profile is generated for the application. The application profile is based at least in part on behavior of the application as observed through the monitoring of the application. The application profile defines one or more access controls associated with the application.