From Access Control to Action Control

What this chapter covers

Once you accept that agents act, not just read, you need a new control model. This chapter introduces action control — a way to describe, permission, and audit what any agent is allowed to do, at what scale, and under what conditions.

Key takeaways

• The anatomy of an action policy: actor, action, resource, condition, and blast radius
• How to translate business rules into machine-checkable action policies
• Patterns for reversible, semi-reversible, and irreversible actions
• How action control layers on top of existing IAM
• A worked example: an internal support agent with escalating permissions