Action: execution through the platform, never around it

Why must agents consume platforms, not raw infrastructure?

Hand an agent unrestricted AWS or Kubernetes credentials and you have removed every boundary between intent and blast radius. The platform exists precisely to intermediate: its golden paths encode organizational defaults, its pipelines encode process, its APIs encode limits. When the agent consumes those, every action inherits validation, attribution, and reversibility for free. This is the first of the seven principles — and the one from which the rest mostly follow.

What properties must the action plane guarantee?

• →Scoped authority. Each action executes under an identity that names the agent, the principal on whose behalf it acts, and the exact permissions this class of action requires.
• →Validation before mutation. Policy checks run before anything changes — the OPA-gated golden path in the demo is exactly this property, made visible.
• →Reversibility semantics. Every action carries a rollback story. Irreversible actions are a separate, human-gated class.
• →Idempotence and reconciliation. Actions converge state rather than blindly applying deltas, so retries are safe and drift self-corrects.
• →Complete traces. Who acted, what was approved, what executed, what changed — recorded as evidence for observability and audit.

What is progressive autonomy in execution?

Not every action deserves the same trust on day one. The action plane supports a ladder — read → recommend → propose → execute → remediate — where each rung is earned per action class, evidenced by trace history, and revocable. A platform might let an agent execute config refactors autonomously after a month of clean proposals, while production deploys of PCI workloads stay permanently behind a human approval gate. Autonomy is a per-class setting with a paper trail, never a global toggle.

What happens without this plane?

"Agent with a shell" is the anti-pattern: unbounded execution, no attribution, no validation, no rollback. It works beautifully in demos and fails categorically in production — not because models are unreliable, but because nothing between the model and the infrastructure is accountable. The action plane is where agentic platform engineering earns its keep.