I know there’s other projects with the goal to generate policies from the live behaviour of apps but I’ve always wondered how practical that actually is.

It seems difficult to make sure you actually exercise every path of your app so that it makes every API call.

It makes me wonder if live monitoring or static analysis is the better approach.