You can also write a stub policy which is permissive for all actions, with logging turned on. This means you can run just the one application in permissive mode

You can also write a stub policy which is permissive for all actions, with logging turned on. This means you can run just the one application in permissive mode, get a sense of its behavior, and then lock it down.