In some examples, a system tests a program that includes code to invoke calls of an application programming interface (API) for managing resources of a cloud environment. As part of the testing of the program, the system determines permissions for the invoked calls of the API, creates a collection of the determined permissions, and associates the collection of the determined permissions with an access policy of the cloud environment, the access policy to control use of the API for managing resources of the cloud environment.