The actions that an external principal is granted permission to use by the policy that generated the finding.