Action control guides · Identity and agent actions
Identity names the caller. Policy decides whether its change runs.
Authentication establishes which agent or operator made the request. The decision also depends on what the change touches, what the policy grants, and who owns the system.
Identity is one input to the decision
The same authenticated agent reads a user list, suspends a Google Workspace account, or removes an AWS administrator. Each change carries different risk, and the credential is identical.
Evaluate the requested change
Deixic checks identity alongside the target system, the policy you granted, and the evidence attached to the work. Sensitive changes wait for the owner responsible for the system or the decision.
- Who
- Agent and owner
- What
- Change and target
- Why
- Failing control and evidence
- Decision
- Allow, refuse, or require approval
Keep the receipt
The request, the approver, the decision, the read-back checks, and the result stay together as signed, hash-linked records, so an auditor can reconstruct who authorized each change.
- Receipt
- Before and after state, authorization, read-back
Reuse the fix the next time the control fails.
Activity history records each fix and the authority behind it. Save a repeated fix as a skill and replay real sessions when the method changes.
See compliance executionSee the execution path