1. A method comprising: under control of one or more computer systems configured with specific executable instructions, authenticating an entity that requests to interact with resources of a remote-computing service, the entity comprising one of multiple entities that request to interact with resources of the remote-computing service, a first portion of the multiple entities being associated with a first mode indicating that interactions are to be tracked for crafting an access policy, and a second portion of the multiple entities associated with a second, different mode, the second mode indicating that interactions are not to be tracked for crafting the access policy; determining, based at least in part on the authenticating, that the entity is associated with the first mode; determining a training procedure that provides the entity with access to predetermined resources of the remote-computing service for a predetermined interval; in response to the determining that the entity is associated with the first mode, tracking interactions between the entity and the predetermined resources of the remote-computing service during the training procedure; in response to expiration of the predetermined interval, crafting the access policy for the entity based at least in part on the tracked interactions between the entity and the predetermined resources of the remote-computing service that occurred during the training procedure; and associating the access policy with the entity and associating the entity with the second mode.