Action Taxonomy

Canonical domain:scope:verb event classification with 7 domains and 150+ actions

Action Taxonomy

All agent events are normalized to a canonical domain:scope:verb format before processing. This taxonomy is used across the entire stack: API ingestion, graph builder, GNN scorer, RAG pipeline, and customer dashboard.

Format

{domain}:{scope}:{verb}

• domain — System category: mcp, tool, data, auth, net, sys, agent
• scope — Specific service or context within that domain
• verb — Atomic operation performed

mcp:github:repo.read
tool:database:query.execute
data:field:pii.access
auth:oauth:token.request

Validation regex: ^[a-z][a-z0-9_]*:[a-z][a-z0-9_]*:[a-z][a-z0-9_.]*$

Domains

mcp

Model Context Protocol — Actions through MCP server connections. Highest-growth category.

MCP Lifecycle

Action	Description
mcp:server:connect	Agent connects to MCP server
mcp:server:disconnect	Agent disconnects
mcp:server:authenticate	Agent authenticates with server
mcp:server:list_tools	Agent discovers available tools
mcp:server:list_resources	Agent discovers resources
mcp:server:update	Server version change detected

Productivity & Collaboration

Action	Description
mcp:slack:message.send	Send Slack message
mcp:slack:file.upload	Upload file to Slack
mcp:notion:page.read	Read Notion page
mcp:notion:page.write	Create/update Notion page
mcp:gmail:email.send	Send email via Gmail
mcp:gmail:email.forward	Forward email
mcp:linear:issue.create	Create Linear issue
mcp:jira:issue.create	Create Jira issue

Development & DevOps

Action	Description
mcp:github:repo.read	Read repository content
mcp:github:pr.create	Create pull request
mcp:github:pr.merge	Merge pull request
mcp:github:secret.read	Read repository secrets
mcp:docker:container.create	Create Docker container
mcp:k8s:secret.read	Read Kubernetes secrets
mcp:terraform:apply.execute	Apply Terraform changes

Data & Analytics

Action	Description
mcp:postgres:query.execute	Execute PostgreSQL query
mcp:snowflake:data.export	Export from Snowflake
mcp:s3:object.read	Read S3 object
mcp:s3:object.write	Write S3 object
mcp:redis:key.read	Read Redis key

Cloud & Infrastructure

Action	Description
mcp:aws:iam.role.modify	Modify IAM role
mcp:aws:secrets.read	Read AWS Secrets Manager
mcp:gcp:iam.modify	Modify GCP IAM
mcp:cloudflare:dns.modify	Modify DNS

CRM & Business

Action	Description
mcp:salesforce:record.read	Read Salesforce record
mcp:stripe:payment.create	Create payment
mcp:hubspot:contact.write	Create/update contact

tool

Direct Agent Tool Calls — Framework-native tools (LangChain, CrewAI, AutoGen).

Action	Description
tool:database:query.execute	Execute database query
tool:database:record.export	Export records
tool:file:read	Read file contents
tool:file:write	Write file contents
tool:file:search	Search files
tool:api:request.send	Send HTTP API request
tool:code:execute	Execute code in sandbox
tool:email:send	Send email
tool:rag:search	Search RAG knowledge base
tool:web:search	Perform web search

data

Data Field Access Events — Generated when parsing tool/MCP results.

Action	Description
data:field:pii.access	PII accessed (name, email, phone)
data:field:pii_sensitive.access	Sensitive PII (SSN, passport)
data:field:financial.access	Financial data (credit card, bank)
data:field:health.access	Health/medical data
data:field:auth.access	Auth data (passwords, tokens)
data:field:legal.access	Legal data (contracts, NDA)

auth

Authentication & Authorization Events

Action	Description
auth:oauth:token.request	Request OAuth token
auth:oauth:scope.expand	Token scope expanded
auth:session:elevate	Privileges elevated
auth:permission:grant	Permission granted
auth:permission:revoke	Permission revoked
auth:mfa:challenge	MFA challenge triggered

net / sys / agent

Network (net)

Action	Description
net:http:request.send	Outbound HTTP request
net:external:data.send	Data sent externally
net:dns:lookup.execute	DNS lookup

System (sys)

Action	Description
sys:env:var.read	Environment variable read
sys:process:command.execute	System command executed
sys:package:install	Package installed

Agent (agent)

Action	Description
agent:session:start	Session initiated
agent:reasoning:tool.select	Agent selects tool
agent:delegation:task.assign	Task delegated
agent:guardrail:triggered	Guardrail activated
agent:guardrail:bypassed	Guardrail bypassed

Compound Threat Sequences

The GNN detects multi-step attack patterns across PRECEDED_BY edges:

# Exfiltration Chain
tool:database:query.execute → data:field:pii_sensitive.access → net:external:data.send

# Privilege Escalation
auth:permission:check → auth:permission:grant → auth:session:elevate → tool:database:query.execute

# Tool Poisoning (MCP)
mcp:server:connect → mcp:server:list_tools → agent:reasoning:tool.select → mcp:{poisoned_action} → data:field:auth.access → net:external:data.send

# Supply Chain
mcp:server:update → mcp:server:list_tools [descriptions changed] → agent:reasoning:tool.invoke → sys:process:command.execute

Policy Matching

Customer policies reference actions using glob patterns:

# Block all external email sends
- rule: block
  match: "mcp:gmail:email.send"

# Flag any PII access followed by external send
- rule: flag
  match_sequence:
    - "data:field:pii*.access"
    - "net:external:data.send OR mcp:*:*.send"
  within: 300  # seconds

# Block unverified MCP server connections
- rule: flag
  match: "mcp:server:connect"
  condition: "mcp_context.is_verified == false"

GNN Feature Encoding

When building the graph, the action string is decomposed into features:

Feature	Encoding	Dimension
domain	One-hot: mcp, tool, data, auth, net, sys, agent	7
scope	Learned embedding (hash of scope string)	32
verb	One-hot from standard verbs table	20
action_full	Learned embedding (hash of full action string)	64

The GNN uses both decomposed features (for pattern generalization) and full action embedding (for specific action recognition).