his paper presents an approach to statically retrofit legacy servers with mechanisms for authorization policy enforcement. The approach is based upon the obser- vation that security-sensitive operations performed by a server are characterized by idiomatic resource manipula- tions, called fingerprints. Candidate fingerprints are auto- matically mined by clustering resource manipulations using concept analysis. These fingerprints are then used to iden- tify security-sensitive operations performed by the server. Case studies with three real-world servers show that the approach can be used to identify security-sensitive opera- tions with a few hours of manual effort and modest domain knowledge.