Through a per-domain Agent Action policy, and the defaults are deliberately cautious: agent actions are off until enabled, and dry-run until you turn that off. Beyond that you allowlist which verbs are permitted, create, update, publish, configure, revert and which entity types they apply to, cap how many actions can run per hour, and read a full audit log of everything attempted, with a configurable retention period.