# Authenticated Actions

URL: /systems/trust-and-governance/controls/authenticated-actions · Id: `control:authenticated-actions`

> Every Action runs under an authenticated identity, a Person or an agent Worker, recorded as its `by`.

Every [Action](/business/nouns/action) runs under an authenticated identity, a [Person](/business/nouns/person) or an agent [Worker](/business/nouns/worker), recorded as its `by`.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 CC6.1](/systems/trust-and-governance/criteria/soc2/cc6-1) | The entity implements logical access security software, infrastructure and architectures over protected information assets. |
| [ISO27001 A.5.16](/systems/trust-and-governance/criteria/iso27001/a-5-16) | The full life of every identity is managed. |
| [ISO27001 A.8.5](/systems/trust-and-governance/criteria/iso27001/a-8-5) | Secure authentication technologies and procedures are implemented according to access restrictions. |
| [HIPAA 164.312(d)](/systems/trust-and-governance/criteria/hipaa/164-312-d) | The entity verifies that a person or entity seeking access is the one claimed. |

## Implemented by
- [Security](/workflows/processes/security)
- [Identity](/code/platform/identity)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action in the report period. |
| Assert | Each records a `by` that resolves to an authenticated Worker or Person, and none ran anonymously. |

## Owner
[Security Engineer](/agents/engineering/security-engineer), [Engineering Team](/agents/engineering).

## Example
A webhook arrives with no valid signature asking to mark an [Order](/business/nouns/order) paid. No authenticated identity can be recorded as `by`, so the Action never runs.