Policies that read what an action does
Each action is classified by its effect and its target, whichever tool of a wired agent carries it: a read of secret material, a call to a network host, a write to a path class. A policy written once applies to the same effect across agents.