A computer-implemented method for automatically processing diversely structured permission, operational, or security policies, the method comprising: identifying a first policy (201, 403) associated with a first application or a first computer code; applying a language processing protocol to the first policy to interpret the first policy and extract one or more first attributes of the first policy, wherein the first policy is defined using a first vocabulary and a first syntax; normalizing the first policy to define the first policy using a standardized vocabulary and a standardized syntax agnostic to an infrastructure or service associated with the first application or the first computer code, wherein one or more of the first vocabulary and first syntax are respectively different from the standardized vocabulary and the standardized syntax and wherein the normalizing the first policy comprises translating the one or more first attributes of the first policy; characterized in: determining that the normalized first policy belongs to a policy cluster of one or more policy clusters identified based on the plurality of normalized policies; and, comparing the normalized first policy relative to a plurality of previously normalized policies to determine whether a potentially malicious activity is associated with the first application or the first computer code, wherein the comparing comprises comparing the normalized first policy to normalized policies within the policy cluster, and wherein, if the normalized first policy differs from one or more normalized policies in the policy cluster, whether the potentially malicious activity is associated with the first application or the first computer code is determined based on one or more differences between the normalized first policy and the normalized policies in the policy cluster. identifying a first policy (201, 403) associated with a first application or a first computer code; applying a language processing protocol to the first policy to interpret the first policy and extract one or more first attributes of the first policy, wherein the first policy is defined using a first vocabulary and a first syntax; normalizing the first policy to define the first policy using a standardized vocabulary and a standardized syntax agnostic to an infrastructure or service associated with the first application or the first computer code, wherein one or more of the first vocabulary and first syntax are respectively different from the standardized vocabulary and the standardized syntax and wherein the normalizing the first policy comprises translating the one or more first attributes of the first policy; characterized in: determining that the normalized first policy belongs to a policy cluster of one or more policy clusters identified based on the plurality of normalized policies; and, comparing the normalized first policy relative to a plurality of previously normalized policies to determine whether a potentially malicious activity is associated with the first application or the first computer code, wherein the comparing comprises comparing the normalized first policy to normalized policies within the policy cluster, and wherein, if the normalized first policy differs from one or more normalized policies in the policy cluster, whether the potentially malicious activity is associated with the first application or the first computer code is determined based on one or more differences between the normalized first policy and the normalized policies in the policy cluster. determining that the normalized first policy belongs to a policy cluster of one or more policy clusters identified based on the plurality of normalized policies; and, comparing the normalized first policy relative to a plurality of previously normalized policies to determine whether a potentially malicious activity is associated with the first application or the first computer code, wherein the comparing comprises comparing the normalized first policy to normalized policies within the policy cluster, and wherein, if the normalized first policy differs from one or more normalized policies in the policy cluster, whether the potentially malicious activity is associated with the first application or the first computer code is determined based on one or more differences between the normalized first policy and the normalized policies in the policy cluster. wherein the comparing comprises comparing the normalized first policy to normalized policies within the policy cluster, and wherein, if the normalized first policy differs from one or more normalized policies in the policy cluster, whether the potentially malicious activity is associated with the first application or the first computer code is determined based on one or more differences between the normalized first policy and the normalized policies in the policy cluster.