{"id":"AGT-007","section":"Agent & MCP Governance","requirement":"Map the actions available via each connector.","acceptance":"Show, per connector/MCP server, what actions are available and which are currently enabled.","tier":"AT3, AT4, AT6","whyItMatters":"Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.","verificationMethod":"W","verificationTest":"For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.","formerly":"DIS-008","alsoIn":["spm"],"sort":42,"adoptionContext":null,"mappings":[{"frameworks":["soc2","iso27001"],"explanation":"An inventory of connector actions and their enabled status supports risk assessment and access-rights review. It provides review inputs; it does not demonstrate effective permissions or their enforcement.","kind":"framework","references":{"soc2":["CC3.2","CC6.3"],"iso27001":["Cl. 6.1.2","A.5.18"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Knowing which actions a connector exposes helps identify risks and control needs associated with third-party components.","kind":"framework","references":{"rmf":["MAP 4.2"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Reviewing available and enabled actions helps identify unnecessarily broad functionality. Assessing identity and privilege abuse also requires evidence about agent identities, credentials and delegated permissions. These mappings concern action visibility and review, not reachable-file discovery or data-flow mapping.","kind":"framework","references":{"owasp":["ASI03"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-007","frameworkRefs":{"ISO27001":["Cl. 6.1.2","A.5.18"],"NIST-AI-RMF":["MAP 4.2"],"SOC2":["CC3.2","CC6.3"],"OWASP-ASI":["ASI03"]}}