Example embodiments disclosed herein relate to determining permissible activity in an application. Application programming interfaces (APIs) of an application are monitored using a runtime agent. Information about the APIs is provided to a rules engine. A set of rules describing permissible activity is received from the rules engine.