# AGT-007: Map the actions available via each connector.


- Area: Agent & MCP Governance

- Verification: Walkthrough
- OWASP adoption tier: AT3, AT4, AT6
- Formerly: DIS-008
- URL: /r/AGT-007

**Acceptance criteria:** Show, per connector/MCP server, what actions are available and which are currently enabled.

**Why it matters:** Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.

**How to verify:** For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.

**Mappings:**
- SOC 2: CC3.2, CC6.3; ISO 27001: Cl. 6.1.2, A.5.18 — An inventory of connector actions and their enabled status supports risk assessment and access-rights review. It provides review inputs; it does not demonstrate effective permissions or their enforcement.
- NIST AI RMF: MAP 4.2 — Knowing which actions a connector exposes helps identify risks and control needs associated with third-party components.
- OWASP ASI: ASI03 — Reviewing available and enabled actions helps identify unnecessarily broad functionality. Assessing identity and privilege abuse also requires evidence about agent identities, credentials and delegated permissions. These mappings concern action visibility and review, not reachable-file discovery or data-flow mapping.