A method, comprising: receiving (105,410), by a device, an application to be executed by an operating system of a client device; processing (110,420), by the device and with a heuristic model, the application to identify a first set of file paths with process identifiers; processing (115,430), by the device and with a first machine learning model, the application to identify a second set of file paths with process identifiers; identifying (120,440), by the device, patterns associated with the first set of file paths and the second set of file paths; determining (125,450), by the device, positions of random elements in each file path of the first set of file paths and the second set of file paths; processing (130,460), by the device, the patterns and the positions of the random elements to train a second machine learning model; utilizing (135,470), by the device, the second machine learning model to generate: a first set of rules to identify files required for execution of the application, and a second set of rules to identify files not required for execution of the application, wherein the second set of rules enable the operating system of the client device to block the files not required for execution of the application; generating (140,480), by the device, a mandatory access control policy based on the first set of rules and the second set of rules; and causing (145,490), by the device, the mandatory access control policy to be implemented by the operating system of the client device. receiving (105,410), by a device, an application to be executed by an operating system of a client device; processing (110,420), by the device and with a heuristic model, the application to identify a first set of file paths with process identifiers; processing (115,430), by the device and with a first machine learning model, the application to identify a second set of file paths with process identifiers; identifying (120,440), by the device, patterns associated with the first set of file paths and the second set of file paths; determining (125,450), by the device, positions of random elements in each file path of the first set of file paths and the second set of file paths; processing (130,460), by the device, the patterns and the positions of the random elements to train a second machine learning model; utilizing (135,470), by the device, the second machine learning model to generate: a first set of rules to identify files required for execution of the application, and a second set of rules to identify files not required for execution of the application, wherein the second set of rules enable the operating system of the client device to block the files not required for execution of the application; a first set of rules to identify files required for execution of the application, and a second set of rules to identify files not required for execution of the application, wherein the second set of rules enable the operating system of the client device to block the files not required for execution of the application; generating (140,480), by the device, a mandatory access control policy based on the first set of rules and the second set of rules; and causing (145,490), by the device, the mandatory access control policy to be implemented by the operating system of the client device.