1. A method for automatic identification and evaluation of access-control policies using a computing system, the method comprising: using static analysis to configure an access-control policy for a program running on a computing platform and comprising a plurality of components, each component comprising methods and classes; and using a combination of string analysis and a demand-driven-precision permission-tracking algorithm to reduce the number of permissions in the access-control policy generated by the static analysis that are not actually needed.