Amazon IAM Identity Center · Agentic Access

Amazon IAM Identity Center Agentic Access

x-agentic-access generated

Amazon IAM Identity Center exposes 56 API operations that an AI agent could call, of which 56 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.

By consequence: 41 write, 11 physical, and 4 safety-critical.

4 operations are classed safety-critical and should require human-in-the-loop approval at runtime.

Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.

Access ControlAuthenticationIdentity ManagementSingle Sign-On

Operations: 56 Acting: 56 Human-in-the-loop: 4 Method: generated

By consequence

write 41 physical 11 safety-critical 4

Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.

Method	Path	Consequence	Human-in-loop
POST	/#X-Amz-Target=SWBExternalService.CreateInstanceAccessControlAttributeConfiguration	safety-critical	required
POST	/#X-Amz-Target=SWBExternalService.DeleteInstanceAccessControlAttributeConfiguration	safety-critical	required
POST	/#X-Amz-Target=SWBExternalService.DescribeInstanceAccessControlAttributeConfiguration	safety-critical	required
POST	/#X-Amz-Target=SWBExternalService.UpdateInstanceAccessControlAttributeConfiguration	safety-critical	required
POST	/#X-Amz-Target=AWSIdentityStore.CreateGroupMembership	physical	conditional
POST	/#X-Amz-Target=AWSIdentityStore.DeleteGroupMembership	physical	conditional
POST	/#X-Amz-Target=AWSIdentityStore.DescribeGroupMembership	physical	conditional
POST	/#X-Amz-Target=AWSIdentityStore.GetGroupMembershipId	physical	conditional
POST	/#X-Amz-Target=AWSIdentityStore.ListGroupMemberships	physical	conditional
POST	/#X-Amz-Target=AWSIdentityStore.ListGroupMembershipsForMember	physical	conditional
POST	/#X-Amz-Target=SWBExternalService.DescribePermissionSetProvisioningStatus	physical	conditional
POST	/#X-Amz-Target=SWBExternalService.ListAccountsForProvisionedPermissionSet	physical	conditional
POST	/#X-Amz-Target=SWBExternalService.ListPermissionSetProvisioningStatus	physical	conditional
POST	/#X-Amz-Target=SWBExternalService.ListPermissionSetsProvisionedToAccount	physical	conditional
POST	/#X-Amz-Target=SWBExternalService.ProvisionPermissionSet	physical	conditional

Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/amazon-iam-identity-center-identitystore-openapi-original.yml, openapi/amazon-iam-identity-center-sso-admin-openapi-original.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 56
  by_action_class:
    acting: 56
  by_consequence:
    write: 41
    physical: 11
    safety-critical: 4
  human_in_the_loop_required: 4
operations:
- path: /#X-Amz-Target=AWSIdentityStore.CreateGroup
  method: post
  operationId: CreateGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.CreateGroupMembership
  method: post
  operationId: CreateGroupMembership
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.CreateUser
  method: post
  operationId: CreateUser
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DeleteGroup
  method: post
  operationId: DeleteGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DeleteGroupMembership
  method: post
  operationId: DeleteGroupMembership
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DeleteUser
  method: post
  operationId: DeleteUser
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DescribeGroup
  method: post
  operationId: DescribeGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DescribeGroupMembership
  method: post
  operationId: DescribeGroupMembership
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.DescribeUser
  method: post
  operationId: DescribeUser
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.GetGroupId
  method: post
  operationId: GetGroupId
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.GetGroupMembershipId
  method: post
  operationId: GetGroupMembershipId
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.GetUserId
  method: post
  operationId: GetUserId
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.IsMemberInGroups
  method: post
  operationId: IsMemberInGroups
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.ListGroupMemberships
  method: post
  operationId: ListGroupMemberships
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.ListGroupMembershipsForMember
  method: post
  operationId: ListGroupMembershipsForMember
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.ListGroups
  method: post
  operationId: ListGroups
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.ListUsers
  method: post
  operationId: ListUsers
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.UpdateGroup
  method: post
  operationId: UpdateGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=AWSIdentityStore.UpdateUser
  method: post
  operationId: UpdateUser
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.AttachCustomerManagedPolicyReferenceToPermissionSet
  method: post
  operationId: AttachCustomerManagedPolicyReferenceToPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.AttachManagedPolicyToPermissionSet
  method: post
  operationId: AttachManagedPolicyToPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.CreateAccountAssignment
  method: post
  operationId: CreateAccountAssignment
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.CreateInstanceAccessControlAttributeConfiguration
  method: post
  operationId: CreateInstanceAccessControlAttributeConfiguration
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /#X-Amz-Target=SWBExternalService.CreatePermissionSet
  method: post
  operationId: CreatePermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DeleteAccountAssignment
  method: post
  operationId: DeleteAccountAssignment
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DeleteInlinePolicyFromPermissionSet
  method: post
  operationId: DeleteInlinePolicyFromPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DeleteInstanceAccessControlAttributeConfiguration
  method: post
  operationId: DeleteInstanceAccessControlAttributeConfiguration
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DeletePermissionSet
  method: post
  operationId: DeletePermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DeletePermissionsBoundaryFromPermissionSet
  method: post
  operationId: DeletePermissionsBoundaryFromPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DescribeAccountAssignmentCreationStatus
  method: post
  operationId: DescribeAccountAssignmentCreationStatus
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DescribeAccountAssignmentDeletionStatus
  method: post
  operationId: DescribeAccountAssignmentDeletionStatus
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DescribeInstanceAccessControlAttributeConfiguration
  method: post
  operationId: DescribeInstanceAccessControlAttributeConfiguration
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DescribePermissionSet
  method: post
  operationId: DescribePermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DescribePermissionSetProvisioningStatus
  method: post
  operationId: DescribePermissionSetProvisioningStatus
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DetachCustomerManagedPolicyReferenceFromPermissionSet
  method: post
  operationId: DetachCustomerManagedPolicyReferenceFromPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.DetachManagedPolicyFromPermissionSet
  method: post
  operationId: DetachManagedPolicyFromPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.GetInlinePolicyForPermissionSet
  method: post
  operationId: GetInlinePolicyForPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.GetPermissionsBoundaryForPermissionSet
  method: post
  operationId: GetPermissionsBoundaryForPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListAccountAssignmentCreationStatus
  method: post
  operationId: ListAccountAssignmentCreationStatus
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListAccountAssignmentDeletionStatus
  method: post
  operationId: ListAccountAssignmentDeletionStatus
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListAccountAssignments
  method: post
  operationId: ListAccountAssignments
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListAccountsForProvisionedPermissionSet
  method: post
  operationId: ListAccountsForProvisionedPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListCustomerManagedPolicyReferencesInPermissionSet
  method: post
  operationId: ListCustomerManagedPolicyReferencesInPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListInstances
  method: post
  operationId: ListInstances
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListManagedPoliciesInPermissionSet
  method: post
  operationId: ListManagedPoliciesInPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListPermissionSetProvisioningStatus
  method: post
  operationId: ListPermissionSetProvisioningStatus
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListPermissionSets
  method: post
  operationId: ListPermissionSets
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListPermissionSetsProvisionedToAccount
  method: post
  operationId: ListPermissionSetsProvisionedToAccount
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ListTagsForResource
  method: post
  operationId: ListTagsForResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.ProvisionPermissionSet
  method: post
  operationId: ProvisionPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.PutInlinePolicyToPermissionSet
  method: post
  operationId: PutInlinePolicyToPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.PutPermissionsBoundaryToPermissionSet
  method: post
  operationId: PutPermissionsBoundaryToPermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.TagResource
  method: post
  operationId: TagResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.UntagResource
  method: post
  operationId: UntagResource
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /#X-Amz-Target=SWBExternalService.UpdateInstanceAccessControlAttributeConfiguration
  method: post
  operationId: UpdateInstanceAccessControlAttributeConfiguration
  x-agentic-access:
    action-class: acting
    consequence: safety-critical
    subject: required
    audience: null
    token:
      max-ttl: 120
      exchange: true
      purpose-required: true
      proof-of-possession: true
    escalation:
      human-in-the-loop: required
    audit: required
- path: /#X-Amz-Target=SWBExternalService.UpdatePermissionSet
  method: post
  operationId: UpdatePermissionSet
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required