1. A computing system comprising: a plurality of nodes comprising at least one hardware processor and a memory; at least one application comprising software code executing on at least one of the plurality of nodes; a plurality of resources utilized by the application; a memory in communication with the plurality of nodes and accessible by the application, the memory comprising a database comprising an access-control policy mapping a set of principal access permissions to each one of a plurality of principals; and an access-control and integrity policy enforcement component executing on one of the nodes, the access-control and integrity enforcement component comprising: a software analysis module to detect security-sensitive sinks in the software code of the application, each detected security-sensitive sink comprising at least one variable, each variable comprising a plurality of values; an influencing principal detection module to identify all influencing principals comprising all principals located within a current call stack and associated with each detected security-sensitive sink and all principals within the current call stack and outside the current call stack from which one or more of the plurality of values are obtained; a permission label assignment module to assign a permission label to the at least one variable that comprises a set of value access permissions granted to each value in the plurality of values; and an access permission assignment module to assign an overall access permission to each detected security-sensitive sink by taking the intersection of the set of principal access permissions for all influencing principals and the set of value access permissions of all values of all variables of each detected security-sensitive sink.