diff --git a/policy/action.go b/policy/action.go
index edd0bf7..4a26b5d 100644
--- a/policy/action.go
+++ b/policy/action.go
@@ -32,219 +32,219 @@ const (
 	AbortMultipartUploadAction Action = "s3:AbortMultipartUpload"
 
 	// CreateBucketAction - CreateBucket Rest API action.
-	CreateBucketAction = "s3:CreateBucket"
+	CreateBucketAction Action = "s3:CreateBucket"
 
 	// DeleteBucketAction - DeleteBucket Rest API action.
-	DeleteBucketAction = "s3:DeleteBucket"
+	DeleteBucketAction Action = "s3:DeleteBucket"
 
 	// ForceDeleteBucketAction - DeleteBucket Rest API action when x-minio-force-delete flag
 	// is specified.
-	ForceDeleteBucketAction = "s3:ForceDeleteBucket"
+	ForceDeleteBucketAction Action = "s3:ForceDeleteBucket"
 
 	// DeleteBucketPolicyAction - DeleteBucketPolicy Rest API action.
-	DeleteBucketPolicyAction = "s3:DeleteBucketPolicy"
+	DeleteBucketPolicyAction Action = "s3:DeleteBucketPolicy"
 
 	// DeleteBucketCorsAction - DeleteBucketCors Rest API action.
-	DeleteBucketCorsAction = "s3:DeleteBucketCors"
+	DeleteBucketCorsAction Action = "s3:DeleteBucketCors"
 
 	// DeleteObjectAction - DeleteObject Rest API action.
-	DeleteObjectAction = "s3:DeleteObject"
+	DeleteObjectAction Action = "s3:DeleteObject"
 
 	// GetBucketLocationAction - GetBucketLocation Rest API action.
-	GetBucketLocationAction = "s3:GetBucketLocation"
+	GetBucketLocationAction Action = "s3:GetBucketLocation"
 
 	// GetBucketNotificationAction - GetBucketNotification Rest API action.
-	GetBucketNotificationAction = "s3:GetBucketNotification"
+	GetBucketNotificationAction Action = "s3:GetBucketNotification"
 
 	// GetBucketPolicyAction - GetBucketPolicy Rest API action.
-	GetBucketPolicyAction = "s3:GetBucketPolicy"
+	GetBucketPolicyAction Action = "s3:GetBucketPolicy"
 
 	// GetBucketCorsAction - GetBucketCors Rest API action.
-	GetBucketCorsAction = "s3:GetBucketCors"
+	GetBucketCorsAction Action = "s3:GetBucketCors"
 
 	// GetObjectAction - GetObject Rest API action.
-	GetObjectAction = "s3:GetObject"
+	GetObjectAction Action = "s3:GetObject"
 
 	// GetObjectAttributesAction - GetObjectVersionAttributes Rest API action.
-	GetObjectAttributesAction = "s3:GetObjectAttributes"
+	GetObjectAttributesAction Action = "s3:GetObjectAttributes"
 
 	// HeadBucketAction - HeadBucket Rest API action. This action is unused in minio.
-	HeadBucketAction = "s3:HeadBucket"
+	HeadBucketAction Action = "s3:HeadBucket"
 
 	// ListAllMyBucketsAction - ListAllMyBuckets (List buckets) Rest API action.
-	ListAllMyBucketsAction = "s3:ListAllMyBuckets"
+	ListAllMyBucketsAction Action = "s3:ListAllMyBuckets"
 
 	// ListBucketAction - ListBucket Rest API action.
-	ListBucketAction = "s3:ListBucket"
+	ListBucketAction Action = "s3:ListBucket"
 
 	// GetBucketPolicyStatusAction - Retrieves the policy status for a bucket.
-	GetBucketPolicyStatusAction = "s3:GetBucketPolicyStatus"
+	GetBucketPolicyStatusAction Action = "s3:GetBucketPolicyStatus"
 
 	// ListBucketVersionsAction - ListBucketVersions Rest API action.
-	ListBucketVersionsAction = "s3:ListBucketVersions"
+	ListBucketVersionsAction Action = "s3:ListBucketVersions"
 
 	// ListBucketMultipartUploadsAction - ListMultipartUploads Rest API action.
-	ListBucketMultipartUploadsAction = "s3:ListBucketMultipartUploads"
+	ListBucketMultipartUploadsAction Action = "s3:ListBucketMultipartUploads"
 
 	// ListenNotificationAction - ListenNotification Rest API action.
 	// This is MinIO extension.
-	ListenNotificationAction = "s3:ListenNotification"
+	ListenNotificationAction Action = "s3:ListenNotification"
 
 	// ListenBucketNotificationAction - ListenBucketNotification Rest API action.
 	// This is MinIO extension.
-	ListenBucketNotificationAction = "s3:ListenBucketNotification"
+	ListenBucketNotificationAction Action = "s3:ListenBucketNotification"
 
 	// ListMultipartUploadPartsAction - ListParts Rest API action.
-	ListMultipartUploadPartsAction = "s3:ListMultipartUploadParts"
+	ListMultipartUploadPartsAction Action = "s3:ListMultipartUploadParts"
 
 	// PutBucketLifecycleAction - PutBucketLifecycle Rest API action.
-	PutBucketLifecycleAction = "s3:PutLifecycleConfiguration"
+	PutBucketLifecycleAction Action = "s3:PutLifecycleConfiguration"
 
 	// GetBucketLifecycleAction - GetBucketLifecycle Rest API action.
-	GetBucketLifecycleAction = "s3:GetLifecycleConfiguration"
+	GetBucketLifecycleAction Action = "s3:GetLifecycleConfiguration"
 
 	// PutBucketNotificationAction - PutObjectNotification Rest API action.
-	PutBucketNotificationAction = "s3:PutBucketNotification"
+	PutBucketNotificationAction Action = "s3:PutBucketNotification"
 
 	// PutBucketPolicyAction - PutBucketPolicy Rest API action.
-	PutBucketPolicyAction = "s3:PutBucketPolicy"
+	PutBucketPolicyAction Action = "s3:PutBucketPolicy"
 
 	// PutBucketCorsAction - PutBucketCors Rest API action.
-	PutBucketCorsAction = "s3:PutBucketCors"
+	PutBucketCorsAction Action = "s3:PutBucketCors"
 
 	//  PutBucketQOSAction - allow set QOS configuration
-	PutBucketQOSAction = "s3:PutBucketQOS"
+	PutBucketQOSAction Action = "s3:PutBucketQOS"
 
 	//  GetBucketQOSAction - allow get QOS configuration
-	GetBucketQOSAction = "s3:GetBucketQOS"
+	GetBucketQOSAction Action = "s3:GetBucketQOS"
 
 	// PutObjectAction - PutObject Rest API action.
-	PutObjectAction = "s3:PutObject"
+	PutObjectAction Action = "s3:PutObject"
 
 	// DeleteObjectVersionAction - DeleteObjectVersion Rest API action.
-	DeleteObjectVersionAction = "s3:DeleteObjectVersion"
+	DeleteObjectVersionAction Action = "s3:DeleteObjectVersion"
 
 	// DeleteObjectVersionTaggingAction - DeleteObjectVersionTagging Rest API action.
-	DeleteObjectVersionTaggingAction = "s3:DeleteObjectVersionTagging"
+	DeleteObjectVersionTaggingAction Action = "s3:DeleteObjectVersionTagging"
 
 	// GetObjectVersionAction - GetObjectVersionAction Rest API action.
-	GetObjectVersionAction = "s3:GetObjectVersion"
+	GetObjectVersionAction Action = "s3:GetObjectVersion"
 
 	// GetObjectVersionAttributesAction - GetObjectVersionAttributes Rest API action.
-	GetObjectVersionAttributesAction = "s3:GetObjectVersionAttributes"
+	GetObjectVersionAttributesAction Action = "s3:GetObjectVersionAttributes"
 
 	// GetObjectVersionTaggingAction - GetObjectVersionTagging Rest API action.
-	GetObjectVersionTaggingAction = "s3:GetObjectVersionTagging"
+	GetObjectVersionTaggingAction Action = "s3:GetObjectVersionTagging"
 
 	// PutObjectVersionTaggingAction - PutObjectVersionTagging Rest API action.
-	PutObjectVersionTaggingAction = "s3:PutObjectVersionTagging"
+	PutObjectVersionTaggingAction Action = "s3:PutObjectVersionTagging"
 
 	// BypassGovernanceRetentionAction - bypass governance retention for PutObjectRetention, PutObject and DeleteObject Rest API action.
-	BypassGovernanceRetentionAction = "s3:BypassGovernanceRetention"
+	BypassGovernanceRetentionAction Action = "s3:BypassGovernanceRetention"
 
 	// PutObjectRetentionAction - PutObjectRetention Rest API action.
-	PutObjectRetentionAction = "s3:PutObjectRetention"
+	PutObjectRetentionAction Action = "s3:PutObjectRetention"
 
 	// GetObjectRetentionAction - GetObjectRetention, GetObject, HeadObject Rest API action.
-	GetObjectRetentionAction = "s3:GetObjectRetention"
+	GetObjectRetentionAction Action = "s3:GetObjectRetention"
 
 	// GetObjectLegalHoldAction - GetObjectLegalHold, GetObject Rest API action.
-	GetObjectLegalHoldAction = "s3:GetObjectLegalHold"
+	GetObjectLegalHoldAction Action = "s3:GetObjectLegalHold"
 
 	// PutObjectLegalHoldAction - PutObjectLegalHold, PutObject Rest API action.
-	PutObjectLegalHoldAction = "s3:PutObjectLegalHold"
+	PutObjectLegalHoldAction Action = "s3:PutObjectLegalHold"
 
 	// GetBucketObjectLockConfigurationAction - GetBucketObjectLockConfiguration Rest API action
-	GetBucketObjectLockConfigurationAction = "s3:GetBucketObjectLockConfiguration"
+	GetBucketObjectLockConfigurationAction Action = "s3:GetBucketObjectLockConfiguration"
 
 	// PutBucketObjectLockConfigurationAction - PutBucketObjectLockConfiguration Rest API action
-	PutBucketObjectLockConfigurationAction = "s3:PutBucketObjectLockConfiguration"
+	PutBucketObjectLockConfigurationAction Action = "s3:PutBucketObjectLockConfiguration"
 
 	// GetBucketTaggingAction - GetBucketTagging Rest API action
-	GetBucketTaggingAction = "s3:GetBucketTagging"
+	GetBucketTaggingAction Action = "s3:GetBucketTagging"
 
 	// PutBucketTaggingAction - PutBucketTagging Rest API action
-	PutBucketTaggingAction = "s3:PutBucketTagging"
+	PutBucketTaggingAction Action = "s3:PutBucketTagging"
 
 	// GetObjectTaggingAction - Get Object Tags API action
-	GetObjectTaggingAction = "s3:GetObjectTagging"
+	GetObjectTaggingAction Action = "s3:GetObjectTagging"
 
 	// PutObjectTaggingAction - Put Object Tags API action
-	PutObjectTaggingAction = "s3:PutObjectTagging"
+	PutObjectTaggingAction Action = "s3:PutObjectTagging"
 
 	// DeleteObjectTaggingAction - Delete Object Tags API action
-	DeleteObjectTaggingAction = "s3:DeleteObjectTagging"
+	DeleteObjectTaggingAction Action = "s3:DeleteObjectTagging"
 
 	// PutObjectAnnotationAction - PutObjectAnnotation API action
-	PutObjectAnnotationAction = "s3:PutObjectAnnotation"
+	PutObjectAnnotationAction Action = "s3:PutObjectAnnotation"
 
 	// GetObjectAnnotationAction - GetObjectAnnotation API action
-	GetObjectAnnotationAction = "s3:GetObjectAnnotation"
+	GetObjectAnnotationAction Action = "s3:GetObjectAnnotation"
 
 	// DeleteObjectAnnotationAction - DeleteObjectAnnotation API action
-	DeleteObjectAnnotationAction = "s3:DeleteObjectAnnotation"
+	DeleteObjectAnnotationAction Action = "s3:DeleteObjectAnnotation"
 
 	// ListObjectAnnotationsAction - ListObjectAnnotations API action
-	ListObjectAnnotationsAction = "s3:ListObjectAnnotations"
+	ListObjectAnnotationsAction Action = "s3:ListObjectAnnotations"
 
 	// UpdateObjectEncryptionAction - UpdateObjectEncryption REST API action
-	UpdateObjectEncryptionAction = "s3:UpdateObjectEncryption"
+	UpdateObjectEncryptionAction Action = "s3:UpdateObjectEncryption"
 
 	// PutBucketEncryptionAction - PutBucketEncryption REST API action
-	PutBucketEncryptionAction = "s3:PutEncryptionConfiguration"
+	PutBucketEncryptionAction Action = "s3:PutEncryptionConfiguration"
 
 	// GetBucketEncryptionAction - GetBucketEncryption REST API action
-	GetBucketEncryptionAction = "s3:GetEncryptionConfiguration"
+	GetBucketEncryptionAction Action = "s3:GetEncryptionConfiguration"
 
 	// PutBucketVersioningAction - PutBucketVersioning REST API action
-	PutBucketVersioningAction = "s3:PutBucketVersioning"
+	PutBucketVersioningAction Action = "s3:PutBucketVersioning"
 
 	// GetBucketVersioningAction - GetBucketVersioning REST API action
-	GetBucketVersioningAction = "s3:GetBucketVersioning"
+	GetBucketVersioningAction Action = "s3:GetBucketVersioning"
 	// GetReplicationConfigurationAction  - GetReplicationConfiguration REST API action
-	GetReplicationConfigurationAction = "s3:GetReplicationConfiguration"
+	GetReplicationConfigurationAction Action = "s3:GetReplicationConfiguration"
 	// PutReplicationConfigurationAction  - PutReplicationConfiguration REST API action
-	PutReplicationConfigurationAction = "s3:PutReplicationConfiguration"
+	PutReplicationConfigurationAction Action = "s3:PutReplicationConfiguration"
 
 	// ReplicateObjectAction  - ReplicateObject REST API action
-	ReplicateObjectAction = "s3:ReplicateObject"
+	ReplicateObjectAction Action = "s3:ReplicateObject"
 
 	// ReplicateDeleteAction  - ReplicateDelete REST API action
-	ReplicateDeleteAction = "s3:ReplicateDelete"
+	ReplicateDeleteAction Action = "s3:ReplicateDelete"
 
 	// ReplicateTagsAction  - ReplicateTags REST API action
-	ReplicateTagsAction = "s3:ReplicateTags"
+	ReplicateTagsAction Action = "s3:ReplicateTags"
 
 	// GetObjectVersionForReplicationAction  - GetObjectVersionForReplication REST API action
-	GetObjectVersionForReplicationAction = "s3:GetObjectVersionForReplication"
+	GetObjectVersionForReplicationAction Action = "s3:GetObjectVersionForReplication"
 
 	// ReplicateObjectAnnotationAction - ReplicateObjectAnnotation REST API action
-	ReplicateObjectAnnotationAction = "s3:ReplicateObjectAnnotation"
+	ReplicateObjectAnnotationAction Action = "s3:ReplicateObjectAnnotation"
 
 	// GetObjectVersionAnnotationForReplicationAction - GetObjectVersionAnnotationForReplication REST API action
-	GetObjectVersionAnnotationForReplicationAction = "s3:GetObjectVersionAnnotationForReplication"
+	GetObjectVersionAnnotationForReplicationAction Action = "s3:GetObjectVersionAnnotationForReplication"
 
 	// RestoreObjectAction - RestoreObject REST API action
-	RestoreObjectAction = "s3:RestoreObject"
+	RestoreObjectAction Action = "s3:RestoreObject"
 	// ResetBucketReplicationStateAction - MinIO extension API ResetBucketReplicationState to reset replication state
 	// on a bucket
-	ResetBucketReplicationStateAction = "s3:ResetBucketReplicationState"
+	ResetBucketReplicationStateAction Action = "s3:ResetBucketReplicationState"
 
 	// PutObjectFanOutAction - PutObject like API action but allows PostUpload() fan-out.
-	PutObjectFanOutAction = "s3:PutObjectFanOut"
+	PutObjectFanOutAction Action = "s3:PutObjectFanOut"
 
 	// Inventory configuration actions
 
 	// PutInventoryConfigurationAction - Bucket inventory write operations actions
-	PutInventoryConfigurationAction = "s3:PutInventoryConfiguration"
+	PutInventoryConfigurationAction Action = "s3:PutInventoryConfiguration"
 	// GetInventoryConfigurationAction - Bucket inventory read operations actions
-	GetInventoryConfigurationAction = "s3:GetInventoryConfiguration"
+	GetInventoryConfigurationAction Action = "s3:GetInventoryConfiguration"
 
 	// CreateSessionAction - S3Express REST API action
-	CreateSessionAction = "s3express:CreateSession"
+	CreateSessionAction Action = "s3express:CreateSession"
 
 	// AllActions - all API actions
-	AllActions = "s3:*"
+	AllActions Action = "s3:*"
 )
 
 // SupportedActions - list of all supported actions.
diff --git a/policy/actionset.go b/policy/actionset.go
index 525f6ea..930ca9d 100644
--- a/policy/actionset.go
+++ b/policy/actionset.go
@@ -53,44 +53,44 @@ var implicitActions = map[Action]ActionSet{
 	GetObjectVersionAction: NewActionSet(GetObjectAction),
 
 	// S3Tables actions implicitly allow their data actions
-	S3TablesGetTableDataAction: NewActionSet(GetObjectAction, ListMultipartUploadPartsAction),
-	S3TablesPutTableDataAction: NewActionSet(PutObjectAction, AbortMultipartUploadAction, ListBucketAction),
-	// S3TablesDeleteTableAction implicitly allows DeleteObjectAction to support table purging.
+	Action(S3TablesGetTableDataAction): NewActionSet(GetObjectAction, ListMultipartUploadPartsAction),
+	Action(S3TablesPutTableDataAction): NewActionSet(PutObjectAction, AbortMultipartUploadAction, ListBucketAction),
+	// Action(S3TablesDeleteTableAction) implicitly allows DeleteObjectAction to support table purging.
 	// This is needed because Spark's DROP TABLE ... PURGE performs client-side deletes rather than
 	// using purgeRequested=true to let the catalog handle deletion. This workaround grants the
 	// necessary privilege until the issue is fixed in Spark/Iceberg upstream.
 	// See: https://github.com/apache/iceberg/issues/14743
 	//      https://github.com/apache/iceberg/issues/11023
-	S3TablesDeleteTableAction: NewActionSet(DeleteObjectAction),
-	AllS3TablesActions:        NewActionSet(GetObjectAction, PutObjectAction, DeleteObjectAction, ListBucketAction, ListMultipartUploadPartsAction, AbortMultipartUploadAction),
+	Action(S3TablesDeleteTableAction): NewActionSet(DeleteObjectAction),
+	Action(AllS3TablesActions):        NewActionSet(GetObjectAction, PutObjectAction, DeleteObjectAction, ListBucketAction, ListMultipartUploadPartsAction, AbortMultipartUploadAction),
 
 	// TableBucket actions implicitly allow their Warehouse counterparts
-	S3TablesCreateTableBucketAction:                      NewActionSet(S3TablesCreateWarehouseAction),
-	S3TablesDeleteTableBucketAction:                      NewActionSet(S3TablesDeleteWarehouseAction),
-	S3TablesDeleteTableBucketEncryptionAction:            NewActionSet(S3TablesDeleteWarehouseEncryptionAction),
-	S3TablesDeleteTableBucketPolicyAction:                NewActionSet(S3TablesDeleteWarehousePolicyAction),
-	S3TablesGetTableBucketAction:                         NewActionSet(S3TablesGetWarehouseAction),
-	S3TablesGetTableBucketEncryptionAction:               NewActionSet(S3TablesGetWarehouseEncryptionAction),
-	S3TablesGetTableBucketMaintenanceConfigurationAction: NewActionSet(S3TablesGetWarehouseMaintenanceConfigurationAction),
-	S3TablesGetTableBucketPolicyAction:                   NewActionSet(S3TablesGetWarehousePolicyAction),
-	S3TablesListTableBucketsAction:                       NewActionSet(S3TablesListWarehousesAction),
-	S3TablesPutTableBucketEncryptionAction:               NewActionSet(S3TablesPutWarehouseEncryptionAction),
-	S3TablesPutTableBucketMaintenanceConfigurationAction: NewActionSet(S3TablesPutWarehouseMaintenanceConfigurationAction),
-	S3TablesPutTableBucketPolicyAction:                   NewActionSet(S3TablesPutWarehousePolicyAction),
+	Action(S3TablesCreateTableBucketAction):                      NewActionSet(Action(S3TablesCreateWarehouseAction)),
+	Action(S3TablesDeleteTableBucketAction):                      NewActionSet(Action(S3TablesDeleteWarehouseAction)),
+	Action(S3TablesDeleteTableBucketEncryptionAction):            NewActionSet(Action(S3TablesDeleteWarehouseEncryptionAction)),
+	Action(S3TablesDeleteTableBucketPolicyAction):                NewActionSet(Action(S3TablesDeleteWarehousePolicyAction)),
+	Action(S3TablesGetTableBucketAction):                         NewActionSet(Action(S3TablesGetWarehouseAction)),
+	Action(S3TablesGetTableBucketEncryptionAction):               NewActionSet(Action(S3TablesGetWarehouseEncryptionAction)),
+	Action(S3TablesGetTableBucketMaintenanceConfigurationAction): NewActionSet(Action(S3TablesGetWarehouseMaintenanceConfigurationAction)),
+	Action(S3TablesGetTableBucketPolicyAction):                   NewActionSet(Action(S3TablesGetWarehousePolicyAction)),
+	Action(S3TablesListTableBucketsAction):                       NewActionSet(Action(S3TablesListWarehousesAction)),
+	Action(S3TablesPutTableBucketEncryptionAction):               NewActionSet(Action(S3TablesPutWarehouseEncryptionAction)),
+	Action(S3TablesPutTableBucketMaintenanceConfigurationAction): NewActionSet(Action(S3TablesPutWarehouseMaintenanceConfigurationAction)),
+	Action(S3TablesPutTableBucketPolicyAction):                   NewActionSet(Action(S3TablesPutWarehousePolicyAction)),
 
 	// Warehouse actions implicitly allow their TableBucket counterparts
-	S3TablesCreateWarehouseAction:                      NewActionSet(S3TablesCreateTableBucketAction),
-	S3TablesDeleteWarehouseAction:                      NewActionSet(S3TablesDeleteTableBucketAction),
-	S3TablesDeleteWarehouseEncryptionAction:            NewActionSet(S3TablesDeleteTableBucketEncryptionAction),
-	S3TablesDeleteWarehousePolicyAction:                NewActionSet(S3TablesDeleteTableBucketPolicyAction),
-	S3TablesGetWarehouseAction:                         NewActionSet(S3TablesGetTableBucketAction),
-	S3TablesGetWarehouseEncryptionAction:               NewActionSet(S3TablesGetTableBucketEncryptionAction),
-	S3TablesGetWarehouseMaintenanceConfigurationAction: NewActionSet(S3TablesGetTableBucketMaintenanceConfigurationAction),
-	S3TablesGetWarehousePolicyAction:                   NewActionSet(S3TablesGetTableBucketPolicyAction),
-	S3TablesListWarehousesAction:                       NewActionSet(S3TablesListTableBucketsAction),
-	S3TablesPutWarehouseEncryptionAction:               NewActionSet(S3TablesPutTableBucketEncryptionAction),
-	S3TablesPutWarehouseMaintenanceConfigurationAction: NewActionSet(S3TablesPutTableBucketMaintenanceConfigurationAction),
-	S3TablesPutWarehousePolicyAction:                   NewActionSet(S3TablesPutTableBucketPolicyAction),
+	Action(S3TablesCreateWarehouseAction):                      NewActionSet(Action(S3TablesCreateTableBucketAction)),
+	Action(S3TablesDeleteWarehouseAction):                      NewActionSet(Action(S3TablesDeleteTableBucketAction)),
+	Action(S3TablesDeleteWarehouseEncryptionAction):            NewActionSet(Action(S3TablesDeleteTableBucketEncryptionAction)),
+	Action(S3TablesDeleteWarehousePolicyAction):                NewActionSet(Action(S3TablesDeleteTableBucketPolicyAction)),
+	Action(S3TablesGetWarehouseAction):                         NewActionSet(Action(S3TablesGetTableBucketAction)),
+	Action(S3TablesGetWarehouseEncryptionAction):               NewActionSet(Action(S3TablesGetTableBucketEncryptionAction)),
+	Action(S3TablesGetWarehouseMaintenanceConfigurationAction): NewActionSet(Action(S3TablesGetTableBucketMaintenanceConfigurationAction)),
+	Action(S3TablesGetWarehousePolicyAction):                   NewActionSet(Action(S3TablesGetTableBucketPolicyAction)),
+	Action(S3TablesListWarehousesAction):                       NewActionSet(Action(S3TablesListTableBucketsAction)),
+	Action(S3TablesPutWarehouseEncryptionAction):               NewActionSet(Action(S3TablesPutTableBucketEncryptionAction)),
+	Action(S3TablesPutWarehouseMaintenanceConfigurationAction): NewActionSet(Action(S3TablesPutTableBucketMaintenanceConfigurationAction)),
+	Action(S3TablesPutWarehousePolicyAction):                   NewActionSet(Action(S3TablesPutTableBucketPolicyAction)),
 }
 
 // Match - matches object name with anyone of action pattern in action set.
diff --git a/policy/actionset_test.go b/policy/actionset_test.go
index 03560ef..bc55bbc 100644
--- a/policy/actionset_test.go
+++ b/policy/actionset_test.go
@@ -49,7 +49,7 @@ func TestActionSetMatches(t *testing.T) {
 		expectedResult bool
 	}{
 		{NewActionSet(AllActions), AbortMultipartUploadAction, true},
-		{NewActionSet(AllS3TablesActions), S3TablesCreateTableAction, true},
+		{NewActionSet(Action(AllS3TablesActions)), Action(S3TablesCreateTableAction), true},
 		{NewActionSet(PutObjectAction), PutObjectAction, true},
 		{NewActionSet(PutObjectAction, GetObjectAction), PutObjectAction, true},
 		{NewActionSet(PutObjectAction, GetObjectAction), AbortMultipartUploadAction, false},
diff --git a/policy/admin-action.go b/policy/admin-action.go
index 462687e..c7c013b 100644
--- a/policy/admin-action.go
+++ b/policy/admin-action.go
@@ -27,291 +27,291 @@ type AdminAction string
 
 const (
 	// HealAdminAction - allows heal command
-	HealAdminAction = "admin:Heal"
+	HealAdminAction AdminAction = "admin:Heal"
 
 	// DecommissionAdminAction - allows decomissioning of pools
-	DecommissionAdminAction = "admin:Decommission"
+	DecommissionAdminAction AdminAction = "admin:Decommission"
 
 	// RebalanceAdminAction - allows rebalancing of pools
-	RebalanceAdminAction = "admin:Rebalance"
+	RebalanceAdminAction AdminAction = "admin:Rebalance"
 	// Service Actions
 
 	// StorageInfoAdminAction - allow listing server info
-	StorageInfoAdminAction = "admin:StorageInfo"
+	StorageInfoAdminAction AdminAction = "admin:StorageInfo"
 	// PrometheusAdminAction - prometheus info action
-	PrometheusAdminAction = "admin:Prometheus"
+	PrometheusAdminAction AdminAction = "admin:Prometheus"
 	// DataUsageInfoAdminAction - allow listing data usage info
-	DataUsageInfoAdminAction = "admin:DataUsageInfo"
+	DataUsageInfoAdminAction AdminAction = "admin:DataUsageInfo"
 	// ForceUnlockAdminAction - allow force unlocking locks
-	ForceUnlockAdminAction = "admin:ForceUnlock"
+	ForceUnlockAdminAction AdminAction = "admin:ForceUnlock"
 	// TopLocksAdminAction - allow listing top locks
-	TopLocksAdminAction = "admin:TopLocksInfo"
+	TopLocksAdminAction AdminAction = "admin:TopLocksInfo"
 	// ProfilingAdminAction - allow profiling
-	ProfilingAdminAction = "admin:Profiling"
+	ProfilingAdminAction AdminAction = "admin:Profiling"
 	// TraceAdminAction - allow listing server trace
-	TraceAdminAction = "admin:ServerTrace"
+	TraceAdminAction AdminAction = "admin:ServerTrace"
 	// ConsoleLogAdminAction - allow listing console logs on terminal
-	ConsoleLogAdminAction = "admin:ConsoleLog"
+	ConsoleLogAdminAction AdminAction = "admin:ConsoleLog"
 	// KMSEnableAdminAction - allow enabling the builtin KMS
-	KMSEnableAdminAction = "admin:KMSEnable"
+	KMSEnableAdminAction AdminAction = "admin:KMSEnable"
 	// KMSBackupAdminAction - allow backing up builtin KMS keys
-	KMSBackupAdminAction = "admin:KMSBackup"
+	KMSBackupAdminAction AdminAction = "admin:KMSBackup"
 	// KMSRestoreAdminAction - allow restoring builtin KMS keys
-	KMSRestoreAdminAction = "admin:KMSRestore"
+	KMSRestoreAdminAction AdminAction = "admin:KMSRestore"
 	// KMSCreateKeyAdminAction - allow creating a new KMS master key
-	KMSCreateKeyAdminAction = "admin:KMSCreateKey"
+	KMSCreateKeyAdminAction AdminAction = "admin:KMSCreateKey"
 	// KMSKeyStatusAdminAction - allow getting KMS key status
-	KMSKeyStatusAdminAction = "admin:KMSKeyStatus"
+	KMSKeyStatusAdminAction AdminAction = "admin:KMSKeyStatus"
 	// KMSKeyRotateAdminAction - allow rotating KMS keys
-	KMSKeyRotateAdminAction = "admin:KMSKeyRotate"
+	KMSKeyRotateAdminAction AdminAction = "admin:KMSKeyRotate"
 	// ServerInfoAdminAction - allow listing server info
-	ServerInfoAdminAction = "admin:ServerInfo"
+	ServerInfoAdminAction AdminAction = "admin:ServerInfo"
 	// HealthInfoAdminAction - allow obtaining cluster health information
-	HealthInfoAdminAction = "admin:OBDInfo"
+	HealthInfoAdminAction AdminAction = "admin:OBDInfo"
 	// LicenseInfoAdminAction - allow obtaining license information
-	LicenseInfoAdminAction = "admin:LicenseInfo"
+	LicenseInfoAdminAction AdminAction = "admin:LicenseInfo"
 	// BandwidthMonitorAction - allow monitoring bandwidth usage
-	BandwidthMonitorAction = "admin:BandwidthMonitor"
+	BandwidthMonitorAction AdminAction = "admin:BandwidthMonitor"
 	// InspectDataAction - allows downloading raw files from backend
-	InspectDataAction = "admin:InspectData"
+	InspectDataAction AdminAction = "admin:InspectData"
 
 	// ServerUpdateAdminAction - allow MinIO binary update
-	ServerUpdateAdminAction = "admin:ServerUpdate"
+	ServerUpdateAdminAction AdminAction = "admin:ServerUpdate"
 	// ServiceRestartAdminAction - allow restart of MinIO service.
-	ServiceRestartAdminAction = "admin:ServiceRestart"
+	ServiceRestartAdminAction AdminAction = "admin:ServiceRestart"
 	// ServiceStopAdminAction - allow stopping MinIO service.
-	ServiceStopAdminAction = "admin:ServiceStop"
+	ServiceStopAdminAction AdminAction = "admin:ServiceStop"
 	// ServiceFreezeAdminAction - allow freeze/unfreeze MinIO service.
-	ServiceFreezeAdminAction = "admin:ServiceFreeze"
+	ServiceFreezeAdminAction AdminAction = "admin:ServiceFreeze"
 	// ServiceCordonAdminAction - allow cordon/uncordon MinIO service.
-	ServiceCordonAdminAction = "admin:ServiceCordon"
+	ServiceCordonAdminAction AdminAction = "admin:ServiceCordon"
 
 	// ConfigUpdateAdminAction - allow MinIO config management
-	ConfigUpdateAdminAction = "admin:ConfigUpdate"
+	ConfigUpdateAdminAction AdminAction = "admin:ConfigUpdate"
 
 	// CreateUserAdminAction - allow creating MinIO user
-	CreateUserAdminAction = "admin:CreateUser"
+	CreateUserAdminAction AdminAction = "admin:CreateUser"
 	// DeleteUserAdminAction - allow deleting MinIO user
-	DeleteUserAdminAction = "admin:DeleteUser"
+	DeleteUserAdminAction AdminAction = "admin:DeleteUser"
 	// ListUsersAdminAction - allow list users permission
-	ListUsersAdminAction = "admin:ListUsers"
+	ListUsersAdminAction AdminAction = "admin:ListUsers"
 	// EnableUserAdminAction - allow enable user permission
-	EnableUserAdminAction = "admin:EnableUser"
+	EnableUserAdminAction AdminAction = "admin:EnableUser"
 	// DisableUserAdminAction - allow disable user permission
-	DisableUserAdminAction = "admin:DisableUser"
+	DisableUserAdminAction AdminAction = "admin:DisableUser"
 	// GetUserAdminAction - allows GET permission on user info
-	GetUserAdminAction = "admin:GetUser"
+	GetUserAdminAction AdminAction = "admin:GetUser"
 	// ChangeMyPasswordAdminAction - allow changing own password
-	ChangeMyPasswordAdminAction = "admin:ChangeMyPassword"
+	ChangeMyPasswordAdminAction AdminAction = "admin:ChangeMyPassword"
 
 	// Cluster Replicate Actions
 
 	// SiteReplicationAddAction - allow adding clusters for site-level replication
-	SiteReplicationAddAction = "admin:SiteReplicationAdd"
+	SiteReplicationAddAction AdminAction = "admin:SiteReplicationAdd"
 	// SiteReplicationDisableAction - allow disabling a cluster from replication
-	SiteReplicationDisableAction = "admin:SiteReplicationDisable"
+	SiteReplicationDisableAction AdminAction = "admin:SiteReplicationDisable"
 	// SiteReplicationRemoveAction - allow removing a cluster from replication
-	SiteReplicationRemoveAction = "admin:SiteReplicationRemove"
+	SiteReplicationRemoveAction AdminAction = "admin:SiteReplicationRemove"
 	// SiteReplicationResyncAction - allow resyncing cluster data to another site
-	SiteReplicationResyncAction = "admin:SiteReplicationResync"
+	SiteReplicationResyncAction AdminAction = "admin:SiteReplicationResync"
 	// SiteReplicationInfoAction - allow getting site replication info
-	SiteReplicationInfoAction = "admin:SiteReplicationInfo"
+	SiteReplicationInfoAction AdminAction = "admin:SiteReplicationInfo"
 	// SiteReplicationOperationAction - allow performing site replication
 	// create/update/delete operations to peers
-	SiteReplicationOperationAction = "admin:SiteReplicationOperation"
+	SiteReplicationOperationAction AdminAction = "admin:SiteReplicationOperation"
 
 	// Tables Replication Actions
 
 	// TablesReplicationAddAction - allow adding tables replication targets
-	TablesReplicationAddAction = "admin:TablesReplicationAdd"
+	TablesReplicationAddAction AdminAction = "admin:TablesReplicationAdd"
 	// TablesReplicationRemoveAction - allow removing tables replication targets
-	TablesReplicationRemoveAction = "admin:TablesReplicationRemove"
+	TablesReplicationRemoveAction AdminAction = "admin:TablesReplicationRemove"
 	// TablesReplicationInfoAction - allow getting tables replication info/status
-	TablesReplicationInfoAction = "admin:TablesReplicationInfo"
+	TablesReplicationInfoAction AdminAction = "admin:TablesReplicationInfo"
 	// TablesReplicationStartFailoverAction - allow starting tables replication failover
-	TablesReplicationStartFailoverAction = "admin:TablesReplicationStartFailover"
+	TablesReplicationStartFailoverAction AdminAction = "admin:TablesReplicationStartFailover"
 	// TablesReplicationCatalogAdminAction - allow catalog debugging operations (reset, dump contents)
-	TablesReplicationCatalogAdminAction = "admin:TablesReplicationCatalogAdmin"
+	TablesReplicationCatalogAdminAction AdminAction = "admin:TablesReplicationCatalogAdmin"
 
 	// Service account Actions
 
 	// CreateServiceAccountAdminAction - allow create a service account for a user
-	CreateServiceAccountAdminAction = "admin:CreateServiceAccount"
+	CreateServiceAccountAdminAction AdminAction = "admin:CreateServiceAccount"
 	// UpdateServiceAccountAdminAction - allow updating a service account
-	UpdateServiceAccountAdminAction = "admin:UpdateServiceAccount"
+	UpdateServiceAccountAdminAction AdminAction = "admin:UpdateServiceAccount"
 	// RemoveServiceAccountAdminAction - allow removing a service account
-	RemoveServiceAccountAdminAction = "admin:RemoveServiceAccount"
+	RemoveServiceAccountAdminAction AdminAction = "admin:RemoveServiceAccount"
 	// ListServiceAccountsAdminAction - allow listing service accounts
-	ListServiceAccountsAdminAction = "admin:ListServiceAccounts"
+	ListServiceAccountsAdminAction AdminAction = "admin:ListServiceAccounts"
 
 	// ListTemporaryAccountsAdminAction - allow listing of temporary accounts
-	ListTemporaryAccountsAdminAction = "admin:ListTemporaryAccounts"
+	ListTemporaryAccountsAdminAction AdminAction = "admin:ListTemporaryAccounts"
 
 	// Group Actions
 
 	// AddUserToGroupAdminAction - allow adding user to group permission
-	AddUserToGroupAdminAction = "admin:AddUserToGroup"
+	AddUserToGroupAdminAction AdminAction = "admin:AddUserToGroup"
 	// RemoveUserFromGroupAdminAction - allow removing user to group permission
-	RemoveUserFromGroupAdminAction = "admin:RemoveUserFromGroup"
+	RemoveUserFromGroupAdminAction AdminAction = "admin:RemoveUserFromGroup"
 	// GetGroupAdminAction - allow getting group info
-	GetGroupAdminAction = "admin:GetGroup"
+	GetGroupAdminAction AdminAction = "admin:GetGroup"
 	// ListGroupsAdminAction - allow list groups permission
-	ListGroupsAdminAction = "admin:ListGroups"
+	ListGroupsAdminAction AdminAction = "admin:ListGroups"
 	// EnableGroupAdminAction - allow enable group permission
-	EnableGroupAdminAction = "admin:EnableGroup"
+	EnableGroupAdminAction AdminAction = "admin:EnableGroup"
 	// DisableGroupAdminAction - allow disable group permission
-	DisableGroupAdminAction = "admin:DisableGroup"
+	DisableGroupAdminAction AdminAction = "admin:DisableGroup"
 
 	// Policy Actions
 
 	// CreatePolicyAdminAction - allow create policy permission
-	CreatePolicyAdminAction = "admin:CreatePolicy"
+	CreatePolicyAdminAction AdminAction = "admin:CreatePolicy"
 	// DeletePolicyAdminAction - allow delete policy permission
-	DeletePolicyAdminAction = "admin:DeletePolicy"
+	DeletePolicyAdminAction AdminAction = "admin:DeletePolicy"
 	// GetPolicyAdminAction - allow get policy permission
-	GetPolicyAdminAction = "admin:GetPolicy"
+	GetPolicyAdminAction AdminAction = "admin:GetPolicy"
 	// AttachPolicyAdminAction - allows attaching a policy to a user/group
-	AttachPolicyAdminAction = "admin:AttachUserOrGroupPolicy"
+	AttachPolicyAdminAction AdminAction = "admin:AttachUserOrGroupPolicy"
 	// UpdatePolicyAssociationAction - allows to add/remove policy association
 	// on a user or group.
-	UpdatePolicyAssociationAction = "admin:UpdatePolicyAssociation"
+	UpdatePolicyAssociationAction AdminAction = "admin:UpdatePolicyAssociation"
 	// ListUserPoliciesAdminAction - allows listing user policies
-	ListUserPoliciesAdminAction = "admin:ListUserPolicies"
+	ListUserPoliciesAdminAction AdminAction = "admin:ListUserPolicies"
 
 	// Bucket quota Actions
 
 	// SetBucketQuotaAdminAction - allow setting bucket quota
-	SetBucketQuotaAdminAction = "admin:SetBucketQuota"
+	SetBucketQuotaAdminAction AdminAction = "admin:SetBucketQuota"
 	// GetBucketQuotaAdminAction - allow getting bucket quota
-	GetBucketQuotaAdminAction = "admin:GetBucketQuota"
+	GetBucketQuotaAdminAction AdminAction = "admin:GetBucketQuota"
 
 	// Bucket compression Actions
 
 	// SetBucketCompressionAdminAction - allow setting per-bucket compression config
-	SetBucketCompressionAdminAction = "admin:SetBucketCompression"
+	SetBucketCompressionAdminAction AdminAction = "admin:SetBucketCompression"
 	// GetBucketCompressionAdminAction - allow getting per-bucket compression config
-	GetBucketCompressionAdminAction = "admin:GetBucketCompression"
+	GetBucketCompressionAdminAction AdminAction = "admin:GetBucketCompression"
 
 	// Bucket Target admin Actions
 
 	// SetBucketTargetAction - allow setting bucket target
-	SetBucketTargetAction = "admin:SetBucketTarget"
+	SetBucketTargetAction AdminAction = "admin:SetBucketTarget"
 	// GetBucketTargetAction - allow getting bucket targets
-	GetBucketTargetAction = "admin:GetBucketTarget"
+	GetBucketTargetAction AdminAction = "admin:GetBucketTarget"
 
 	// ReplicationDiff - allow computing the unreplicated objects in a bucket
-	ReplicationDiff = "admin:ReplicationDiff"
+	ReplicationDiff AdminAction = "admin:ReplicationDiff"
 
 	// Bucket import/export admin Actions
 
 	// ImportBucketMetadataAction - allow importing bucket metadata
-	ImportBucketMetadataAction = "admin:ImportBucketMetadata"
+	ImportBucketMetadataAction AdminAction = "admin:ImportBucketMetadata"
 	// ExportBucketMetadataAction - allow exporting bucket metadata
-	ExportBucketMetadataAction = "admin:ExportBucketMetadata"
+	ExportBucketMetadataAction AdminAction = "admin:ExportBucketMetadata"
 
 	// Remote Tier admin Actions
 
 	// SetTierAction - allow adding/editing a remote tier
-	SetTierAction = "admin:SetTier"
+	SetTierAction AdminAction = "admin:SetTier"
 	// ListTierAction - allow listing remote tiers
-	ListTierAction = "admin:ListTier"
+	ListTierAction AdminAction = "admin:ListTier"
 
 	// Migrate IAM admin Actions
 
 	// ExportIAMAction - allow exporting of all IAM info
-	ExportIAMAction = "admin:ExportIAM"
+	ExportIAMAction AdminAction = "admin:ExportIAM"
 	// ImportIAMAction - allow importing IAM info to MinIO
-	ImportIAMAction = "admin:ImportIAM"
+	ImportIAMAction AdminAction = "admin:ImportIAM"
 
 	// Batch Job APIs
 
 	// ListBatchJobsAction allow listing current active jobs
-	ListBatchJobsAction = "admin:ListBatchJobs"
+	ListBatchJobsAction AdminAction = "admin:ListBatchJobs"
 
 	// DescribeBatchJobAction allow getting batch job YAML
-	DescribeBatchJobAction = "admin:DescribeBatchJob"
+	DescribeBatchJobAction AdminAction = "admin:DescribeBatchJob"
 
 	// StartBatchJobAction allow submitting a batch job
-	StartBatchJobAction = "admin:StartBatchJob"
+	StartBatchJobAction AdminAction = "admin:StartBatchJob"
 
 	// CancelBatchJobAction allow canceling a batch job
-	CancelBatchJobAction = "admin:CancelBatchJob"
+	CancelBatchJobAction AdminAction = "admin:CancelBatchJob"
 
 	// GenerateBatchJobAction allow requesting batch job templates
-	GenerateBatchJobAction = "admin:GenerateBatchJob"
+	GenerateBatchJobAction AdminAction = "admin:GenerateBatchJob"
 
 	// Distributed Job APIs
 
 	// DistJobStatusAction allow viewing status of distributed jobs
 	// (decommission and any future job type built on the same framework),
 	// regardless of which job type is being queried.
-	DistJobStatusAction = "admin:DistJobStatus"
+	DistJobStatusAction AdminAction = "admin:DistJobStatus"
 
 	// Inventory Control Actions
 
 	// InventoryControlAction - allows control of inventory jobs
-	InventoryControlAction = "admin:InventoryControl"
+	InventoryControlAction AdminAction = "admin:InventoryControl"
 
 	// All new v4 APIs
 
 	// ClusterInfoAction - allow cluster summary
-	ClusterInfoAction = "admin:ClusterInfo"
+	ClusterInfoAction AdminAction = "admin:ClusterInfo"
 
 	// PoolListAction - allow list how many pools and summary per pool
-	PoolListAction = "admin:PoolList"
+	PoolListAction AdminAction = "admin:PoolList"
 
 	// PoolInfoAction - allow pool specific summary and detail information
-	PoolInfoAction = "admin:PoolInfo"
+	PoolInfoAction AdminAction = "admin:PoolInfo"
 
 	// NodeListAction - allow listing of nodes
-	NodeListAction = "admin:NodeList"
+	NodeListAction AdminAction = "admin:NodeList"
 
 	// NodeInfoAction - allow node specific summary and detailed information
-	NodeInfoAction = "admin:NodeInfo"
+	NodeInfoAction AdminAction = "admin:NodeInfo"
 
 	// SetInfoAction - allow set specific summary and detail
-	SetInfoAction = "admin:SetInfo"
+	SetInfoAction AdminAction = "admin:SetInfo"
 
 	// DriveListAction - allow listing of drives
-	DriveListAction = "admin:DriveList"
+	DriveListAction AdminAction = "admin:DriveList"
 
 	// DriveInfoAction - allow drive specific summary and detail
-	DriveInfoAction = "admin:DriveInfo"
+	DriveInfoAction AdminAction = "admin:DriveInfo"
 
 	// Delta Sharing Actions
 
 	// DeltaSharingAdminAction - allow managing Delta Sharing shares and tokens
-	DeltaSharingAdminAction = "admin:DeltaSharing"
+	DeltaSharingAdminAction AdminAction = "admin:DeltaSharing"
 	// DeltaSharingCreateShareAction - allow creating Delta Sharing shares
-	DeltaSharingCreateShareAction = "admin:DeltaSharingCreateShare"
+	DeltaSharingCreateShareAction AdminAction = "admin:DeltaSharingCreateShare"
 	// DeltaSharingDeleteShareAction - allow deleting Delta Sharing shares
-	DeltaSharingDeleteShareAction = "admin:DeltaSharingDeleteShare"
+	DeltaSharingDeleteShareAction AdminAction = "admin:DeltaSharingDeleteShare"
 	// DeltaSharingListSharesAction - allow listing Delta Sharing shares
-	DeltaSharingListSharesAction = "admin:DeltaSharingListShares"
+	DeltaSharingListSharesAction AdminAction = "admin:DeltaSharingListShares"
 	// DeltaSharingGetShareAction - allow getting Delta Sharing share details
-	DeltaSharingGetShareAction = "admin:DeltaSharingGetShare"
+	DeltaSharingGetShareAction AdminAction = "admin:DeltaSharingGetShare"
 	// DeltaSharingUpdateShareAction - allow updating Delta Sharing shares
-	DeltaSharingUpdateShareAction = "admin:DeltaSharingUpdateShare"
+	DeltaSharingUpdateShareAction AdminAction = "admin:DeltaSharingUpdateShare"
 	// DeltaSharingCreateTokenAction - allow creating Delta Sharing tokens
-	DeltaSharingCreateTokenAction = "admin:DeltaSharingCreateToken"
+	DeltaSharingCreateTokenAction AdminAction = "admin:DeltaSharingCreateToken"
 	// DeltaSharingDeleteTokenAction - allow deleting Delta Sharing tokens
-	DeltaSharingDeleteTokenAction = "admin:DeltaSharingDeleteToken"
+	DeltaSharingDeleteTokenAction AdminAction = "admin:DeltaSharingDeleteToken"
 	// DeltaSharingListTokensAction - allow listing Delta Sharing tokens
-	DeltaSharingListTokensAction = "admin:DeltaSharingListTokens"
+	DeltaSharingListTokensAction AdminAction = "admin:DeltaSharingListTokens"
 	// ReadAlertsAction - allow reading stored alerts
-	ReadAlertsAction = "admin:ReadAlerts"
+	ReadAlertsAction AdminAction = "admin:ReadAlerts"
 
 	// Log Actions
 
 	// ReadAPILogsAction - allow reading stored API logs
-	ReadAPILogsAction = "admin:ReadAPILogs"
+	ReadAPILogsAction AdminAction = "admin:ReadAPILogs"
 	// ReadErrorLogsAction - allow reading stored error logs
-	ReadErrorLogsAction = "admin:ReadErrorLogs"
+	ReadErrorLogsAction AdminAction = "admin:ReadErrorLogs"
 	// ReadAuditLogsAction - allow reading stored audit logs
-	ReadAuditLogsAction = "admin:ReadAuditLogs"
+	ReadAuditLogsAction AdminAction = "admin:ReadAuditLogs"
 
 	// AllAdminActions - provides all admin permissions
-	AllAdminActions = "admin:*"
+	AllAdminActions AdminAction = "admin:*"
 )
 
 // SupportedAdminActions - list of all supported admin actions.
diff --git a/policy/constants.go b/policy/constants.go
index 113b4d6..9d2b6ca 100644
--- a/policy/constants.go
+++ b/policy/constants.go
@@ -63,7 +63,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:       ID(""),
 					Effect:    Deny,
-					Actions:   NewActionSet(CreateUserAdminAction),
+					Actions:   NewActionSet(Action(CreateUserAdminAction)),
 					Resources: NewResourceSet(NewResource("*")),
 				},
 			},
@@ -85,7 +85,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:       ID(""),
 					Effect:    Deny,
-					Actions:   NewActionSet(CreateUserAdminAction),
+					Actions:   NewActionSet(Action(CreateUserAdminAction)),
 					Resources: NewResourceSet(NewResource("*")),
 				},
 			},
@@ -117,11 +117,11 @@ var DefaultPolicies = []struct {
 				{
 					SID:    ID(""),
 					Effect: Allow,
-					Actions: NewActionSet(ProfilingAdminAction,
-						TraceAdminAction, ConsoleLogAdminAction,
-						ServerInfoAdminAction, TopLocksAdminAction,
-						HealthInfoAdminAction, BandwidthMonitorAction,
-						PrometheusAdminAction,
+					Actions: NewActionSet(Action(ProfilingAdminAction),
+						Action(TraceAdminAction), Action(ConsoleLogAdminAction),
+						Action(ServerInfoAdminAction), Action(TopLocksAdminAction),
+						Action(HealthInfoAdminAction), Action(BandwidthMonitorAction),
+						Action(PrometheusAdminAction),
 					),
 					Resources: NewResourceSet(NewResource("*")),
 				},
@@ -138,7 +138,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllS3TablesActions),
+					Actions:    NewActionSet(Action(AllS3TablesActions)),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
 				},
@@ -158,36 +158,36 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// User management
-						CreateUserAdminAction,
-						DeleteUserAdminAction,
-						ListUsersAdminAction,
-						EnableUserAdminAction,
-						DisableUserAdminAction,
-						GetUserAdminAction,
+						Action(CreateUserAdminAction),
+						Action(DeleteUserAdminAction),
+						Action(ListUsersAdminAction),
+						Action(EnableUserAdminAction),
+						Action(DisableUserAdminAction),
+						Action(GetUserAdminAction),
 						// Group management
-						AddUserToGroupAdminAction,
-						RemoveUserFromGroupAdminAction,
-						GetGroupAdminAction,
-						ListGroupsAdminAction,
-						EnableGroupAdminAction,
-						DisableGroupAdminAction,
+						Action(AddUserToGroupAdminAction),
+						Action(RemoveUserFromGroupAdminAction),
+						Action(GetGroupAdminAction),
+						Action(ListGroupsAdminAction),
+						Action(EnableGroupAdminAction),
+						Action(DisableGroupAdminAction),
 						// Policy management
-						CreatePolicyAdminAction,
-						DeletePolicyAdminAction,
-						GetPolicyAdminAction,
-						AttachPolicyAdminAction,
-						UpdatePolicyAssociationAction,
-						ListUserPoliciesAdminAction,
+						Action(CreatePolicyAdminAction),
+						Action(DeletePolicyAdminAction),
+						Action(GetPolicyAdminAction),
+						Action(AttachPolicyAdminAction),
+						Action(UpdatePolicyAssociationAction),
+						Action(ListUserPoliciesAdminAction),
 						// Service account management
-						CreateServiceAccountAdminAction,
-						UpdateServiceAccountAdminAction,
-						RemoveServiceAccountAdminAction,
-						ListServiceAccountsAdminAction,
+						Action(CreateServiceAccountAdminAction),
+						Action(UpdateServiceAccountAdminAction),
+						Action(RemoveServiceAccountAdminAction),
+						Action(ListServiceAccountsAdminAction),
 						// Temporary accounts
-						ListTemporaryAccountsAdminAction,
+						Action(ListTemporaryAccountsAdminAction),
 						// IAM import/export
-						ExportIAMAction,
-						ImportIAMAction,
+						Action(ExportIAMAction),
+						Action(ImportIAMAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -209,53 +209,53 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Server lifecycle
-						ServerUpdateAdminAction,
-						ServiceRestartAdminAction,
-						ServiceStopAdminAction,
-						ServiceFreezeAdminAction,
-						ServiceCordonAdminAction,
+						Action(ServerUpdateAdminAction),
+						Action(ServiceRestartAdminAction),
+						Action(ServiceStopAdminAction),
+						Action(ServiceFreezeAdminAction),
+						Action(ServiceCordonAdminAction),
 						// Server info
-						ServerInfoAdminAction,
-						StorageInfoAdminAction,
+						Action(ServerInfoAdminAction),
+						Action(StorageInfoAdminAction),
 						// Configuration
-						ConfigUpdateAdminAction,
+						Action(ConfigUpdateAdminAction),
 						// Healing & recovery
-						HealAdminAction,
-						ForceUnlockAdminAction,
+						Action(HealAdminAction),
+						Action(ForceUnlockAdminAction),
 						// Pool management
-						DecommissionAdminAction,
-						RebalanceAdminAction,
+						Action(DecommissionAdminAction),
+						Action(RebalanceAdminAction),
 						// Bucket admin
-						SetBucketQuotaAdminAction,
-						GetBucketQuotaAdminAction,
-						SetBucketCompressionAdminAction,
-						GetBucketCompressionAdminAction,
+						Action(SetBucketQuotaAdminAction),
+						Action(GetBucketQuotaAdminAction),
+						Action(SetBucketCompressionAdminAction),
+						Action(GetBucketCompressionAdminAction),
 						// Tiers
-						SetTierAction,
-						ListTierAction,
+						Action(SetTierAction),
+						Action(ListTierAction),
 						// Data & license info
-						LicenseInfoAdminAction,
-						DataUsageInfoAdminAction,
+						Action(LicenseInfoAdminAction),
+						Action(DataUsageInfoAdminAction),
 						// Bucket metadata import/export
-						ImportBucketMetadataAction,
-						ExportBucketMetadataAction,
+						Action(ImportBucketMetadataAction),
+						Action(ExportBucketMetadataAction),
 						// Batch jobs
-						StartBatchJobAction,
-						ListBatchJobsAction,
-						DescribeBatchJobAction,
-						CancelBatchJobAction,
-						GenerateBatchJobAction,
+						Action(StartBatchJobAction),
+						Action(ListBatchJobsAction),
+						Action(DescribeBatchJobAction),
+						Action(CancelBatchJobAction),
+						Action(GenerateBatchJobAction),
 						// Inventory
-						InventoryControlAction,
+						Action(InventoryControlAction),
 						// Cluster topology (v4 APIs)
-						ClusterInfoAction,
-						PoolListAction,
-						PoolInfoAction,
-						NodeListAction,
-						NodeInfoAction,
-						SetInfoAction,
-						DriveListAction,
-						DriveInfoAction,
+						Action(ClusterInfoAction),
+						Action(PoolListAction),
+						Action(PoolInfoAction),
+						Action(NodeListAction),
+						Action(NodeInfoAction),
+						Action(SetInfoAction),
+						Action(DriveListAction),
+						Action(DriveInfoAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -277,50 +277,50 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Warehouse read
-						S3TablesGetWarehouseAction,
-						S3TablesGetWarehouseEncryptionAction,
-						S3TablesGetWarehouseMaintenanceConfigurationAction,
-						S3TablesGetWarehousePolicyAction,
-						S3TablesListWarehousesAction,
+						Action(S3TablesGetWarehouseAction),
+						Action(S3TablesGetWarehouseEncryptionAction),
+						Action(S3TablesGetWarehouseMaintenanceConfigurationAction),
+						Action(S3TablesGetWarehousePolicyAction),
+						Action(S3TablesListWarehousesAction),
 						// Namespace read + property updates
-						S3TablesGetNamespaceAction,
-						S3TablesListNamespacesAction,
-						S3TablesUpdateNamespacePropertiesAction,
+						Action(S3TablesGetNamespaceAction),
+						Action(S3TablesListNamespacesAction),
+						Action(S3TablesUpdateNamespacePropertiesAction),
 						// Table read + data write
-						S3TablesGetTableAction,
-						S3TablesListTablesAction,
-						S3TablesGetTableDataAction,
-						S3TablesPutTableDataAction,
-						S3TablesGetTableEncryptionAction,
-						S3TablesGetTableMaintenanceConfigurationAction,
-						S3TablesGetTableMaintenanceJobStatusAction,
-						S3TablesGetTableMetadataLocationAction,
-						S3TablesGetTablePolicyAction,
+						Action(S3TablesGetTableAction),
+						Action(S3TablesListTablesAction),
+						Action(S3TablesGetTableDataAction),
+						Action(S3TablesPutTableDataAction),
+						Action(S3TablesGetTableEncryptionAction),
+						Action(S3TablesGetTableMaintenanceConfigurationAction),
+						Action(S3TablesGetTableMaintenanceJobStatusAction),
+						Action(S3TablesGetTableMetadataLocationAction),
+						Action(S3TablesGetTablePolicyAction),
 						// Table mutations (non-destructive)
-						S3TablesCreateTableAction,
-						S3TablesUpdateTableAction,
-						S3TablesUpdateTableMetadataLocationAction,
-						S3TablesRenameTableAction,
-						S3TablesRegisterTableAction,
+						Action(S3TablesCreateTableAction),
+						Action(S3TablesUpdateTableAction),
+						Action(S3TablesUpdateTableMetadataLocationAction),
+						Action(S3TablesRenameTableAction),
+						Action(S3TablesRegisterTableAction),
 						// Views full CRUD
-						S3TablesGetViewAction,
-						S3TablesListViewsAction,
-						S3TablesCreateViewAction,
-						S3TablesUpdateViewAction,
-						S3TablesRenameViewAction,
-						S3TablesDeleteViewAction,
-						S3TablesRegisterViewAction,
+						Action(S3TablesGetViewAction),
+						Action(S3TablesListViewsAction),
+						Action(S3TablesCreateViewAction),
+						Action(S3TablesUpdateViewAction),
+						Action(S3TablesRenameViewAction),
+						Action(S3TablesDeleteViewAction),
+						Action(S3TablesRegisterViewAction),
 						// Functions (SQL UDFs) full CRUD
-						S3TablesGetFunctionAction,
-						S3TablesListFunctionsAction,
-						S3TablesCreateFunctionAction,
-						S3TablesUpdateFunctionAction,
-						S3TablesRenameFunctionAction,
-						S3TablesDeleteFunctionAction,
-						S3TablesRegisterFunctionAction,
+						Action(S3TablesGetFunctionAction),
+						Action(S3TablesListFunctionsAction),
+						Action(S3TablesCreateFunctionAction),
+						Action(S3TablesUpdateFunctionAction),
+						Action(S3TablesRenameFunctionAction),
+						Action(S3TablesDeleteFunctionAction),
+						Action(S3TablesRegisterFunctionAction),
 						// Catalog config + metrics
-						S3TablesGetConfigAction,
-						S3TablesTableMetricsAction,
+						Action(S3TablesGetConfigAction),
+						Action(S3TablesTableMetricsAction),
 					),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
@@ -341,32 +341,32 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Warehouse read
-						S3TablesGetWarehouseAction,
-						S3TablesGetWarehouseEncryptionAction,
-						S3TablesGetWarehouseMaintenanceConfigurationAction,
-						S3TablesGetWarehousePolicyAction,
-						S3TablesListWarehousesAction,
+						Action(S3TablesGetWarehouseAction),
+						Action(S3TablesGetWarehouseEncryptionAction),
+						Action(S3TablesGetWarehouseMaintenanceConfigurationAction),
+						Action(S3TablesGetWarehousePolicyAction),
+						Action(S3TablesListWarehousesAction),
 						// Namespace read
-						S3TablesGetNamespaceAction,
-						S3TablesListNamespacesAction,
+						Action(S3TablesGetNamespaceAction),
+						Action(S3TablesListNamespacesAction),
 						// Table read
-						S3TablesGetTableAction,
-						S3TablesListTablesAction,
-						S3TablesGetTableDataAction,
-						S3TablesGetTableEncryptionAction,
-						S3TablesGetTableMaintenanceConfigurationAction,
-						S3TablesGetTableMaintenanceJobStatusAction,
-						S3TablesGetTableMetadataLocationAction,
-						S3TablesGetTablePolicyAction,
+						Action(S3TablesGetTableAction),
+						Action(S3TablesListTablesAction),
+						Action(S3TablesGetTableDataAction),
+						Action(S3TablesGetTableEncryptionAction),
+						Action(S3TablesGetTableMaintenanceConfigurationAction),
+						Action(S3TablesGetTableMaintenanceJobStatusAction),
+						Action(S3TablesGetTableMetadataLocationAction),
+						Action(S3TablesGetTablePolicyAction),
 						// View read
-						S3TablesGetViewAction,
-						S3TablesListViewsAction,
+						Action(S3TablesGetViewAction),
+						Action(S3TablesListViewsAction),
 						// Function read
-						S3TablesGetFunctionAction,
-						S3TablesListFunctionsAction,
+						Action(S3TablesGetFunctionAction),
+						Action(S3TablesListFunctionsAction),
 						// Catalog config + metrics
-						S3TablesGetConfigAction,
-						S3TablesTableMetricsAction,
+						Action(S3TablesGetConfigAction),
+						Action(S3TablesTableMetricsAction),
 					),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
@@ -387,20 +387,20 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Site replication management
-						SiteReplicationAddAction,
-						SiteReplicationDisableAction,
-						SiteReplicationRemoveAction,
-						SiteReplicationResyncAction,
-						SiteReplicationInfoAction,
-						SiteReplicationOperationAction,
+						Action(SiteReplicationAddAction),
+						Action(SiteReplicationDisableAction),
+						Action(SiteReplicationRemoveAction),
+						Action(SiteReplicationResyncAction),
+						Action(SiteReplicationInfoAction),
+						Action(SiteReplicationOperationAction),
 						// Tables replication management
-						TablesReplicationAddAction,
-						TablesReplicationRemoveAction,
-						TablesReplicationInfoAction,
-						TablesReplicationStartFailoverAction,
-						TablesReplicationCatalogAdminAction,
+						Action(TablesReplicationAddAction),
+						Action(TablesReplicationRemoveAction),
+						Action(TablesReplicationInfoAction),
+						Action(TablesReplicationStartFailoverAction),
+						Action(TablesReplicationCatalogAdminAction),
 						// Replication diagnostics
-						ReplicationDiff,
+						Action(ReplicationDiff),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -436,39 +436,39 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// IAM read
-						ListUsersAdminAction,
-						GetUserAdminAction,
-						ListGroupsAdminAction,
-						GetGroupAdminAction,
-						GetPolicyAdminAction,
-						ListUserPoliciesAdminAction,
-						ListServiceAccountsAdminAction,
-						ListTemporaryAccountsAdminAction,
-						ExportIAMAction,
+						Action(ListUsersAdminAction),
+						Action(GetUserAdminAction),
+						Action(ListGroupsAdminAction),
+						Action(GetGroupAdminAction),
+						Action(GetPolicyAdminAction),
+						Action(ListUserPoliciesAdminAction),
+						Action(ListServiceAccountsAdminAction),
+						Action(ListTemporaryAccountsAdminAction),
+						Action(ExportIAMAction),
 						// Replication info (read-only)
-						SiteReplicationInfoAction,
-						TablesReplicationInfoAction,
+						Action(SiteReplicationInfoAction),
+						Action(TablesReplicationInfoAction),
 						// Server & cluster topology (read-only)
-						ServerInfoAdminAction,
-						StorageInfoAdminAction,
-						DataUsageInfoAdminAction,
-						LicenseInfoAdminAction,
-						ClusterInfoAction,
-						PoolListAction,
-						PoolInfoAction,
-						NodeListAction,
-						NodeInfoAction,
-						SetInfoAction,
-						DriveListAction,
-						DriveInfoAction,
+						Action(ServerInfoAdminAction),
+						Action(StorageInfoAdminAction),
+						Action(DataUsageInfoAdminAction),
+						Action(LicenseInfoAdminAction),
+						Action(ClusterInfoAction),
+						Action(PoolListAction),
+						Action(PoolInfoAction),
+						Action(NodeListAction),
+						Action(NodeInfoAction),
+						Action(SetInfoAction),
+						Action(DriveListAction),
+						Action(DriveInfoAction),
 						// Diagnostics (read-only)
-						ProfilingAdminAction,
-						TraceAdminAction,
-						ConsoleLogAdminAction,
-						TopLocksAdminAction,
-						HealthInfoAdminAction,
-						BandwidthMonitorAction,
-						PrometheusAdminAction,
+						Action(ProfilingAdminAction),
+						Action(TraceAdminAction),
+						Action(ConsoleLogAdminAction),
+						Action(TopLocksAdminAction),
+						Action(HealthInfoAdminAction),
+						Action(BandwidthMonitorAction),
+						Action(PrometheusAdminAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -503,14 +503,14 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllAdminActions),
+					Actions:    NewActionSet(Action(AllAdminActions)),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
 				},
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllKMSActions),
+					Actions:    NewActionSet(Action(AllKMSActions)),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
 				},
@@ -524,7 +524,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllS3TablesActions),
+					Actions:    NewActionSet(Action(AllS3TablesActions)),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
 				},
diff --git a/policy/constants_test.go b/policy/constants_test.go
index 3ade940..7458d18 100644
--- a/policy/constants_test.go
+++ b/policy/constants_test.go
@@ -38,7 +38,7 @@ func TestDefaultPolicyReadOnly(t *testing.T) {
 	}
 
 	allowed := NewActionSet(GetBucketLocationAction, GetObjectAction)
-	denied := NewActionSet(CreateUserAdminAction)
+	denied := NewActionSet(Action(CreateUserAdminAction))
 
 	var sawAllow, sawDeny bool
 	for _, s := range p.Statements {
@@ -70,7 +70,7 @@ func TestDefaultPolicyConsoleReadOnly(t *testing.T) {
 	}
 
 	allowed := NewActionSet(GetBucketLocationAction, GetObjectAction, ListBucketAction)
-	denied := NewActionSet(CreateUserAdminAction)
+	denied := NewActionSet(Action(CreateUserAdminAction))
 
 	var sawAllow, sawDeny bool
 	for _, s := range p.Statements {
diff --git a/policy/kms-action.go b/policy/kms-action.go
index a614b76..ae1363a 100644
--- a/policy/kms-action.go
+++ b/policy/kms-action.go
@@ -22,49 +22,49 @@ type KMSAction string
 
 const (
 	// KMSCreateKeyAction - allow creating a new KMS master key
-	KMSCreateKeyAction = "kms:CreateKey"
+	KMSCreateKeyAction KMSAction = "kms:CreateKey"
 	// KMSDeleteKeyAction - allow deleting a KMS master key
-	KMSDeleteKeyAction = "kms:DeleteKey"
+	KMSDeleteKeyAction KMSAction = "kms:DeleteKey"
 	// KMSListKeysAction - allow getting list of KMS keys
-	KMSListKeysAction = "kms:ListKeys"
+	KMSListKeysAction KMSAction = "kms:ListKeys"
 	// KMSImportKeyAction - allow importing KMS key
-	KMSImportKeyAction = "kms:ImportKey"
+	KMSImportKeyAction KMSAction = "kms:ImportKey"
 	// KMSDescribePolicyAction - allow getting KMS policy
-	KMSDescribePolicyAction = "kms:DescribePolicy"
+	KMSDescribePolicyAction KMSAction = "kms:DescribePolicy"
 	// KMSAssignPolicyAction - allow assigning an identity to a KMS policy
-	KMSAssignPolicyAction = "kms:AssignPolicy"
+	KMSAssignPolicyAction KMSAction = "kms:AssignPolicy"
 	// KMSDeletePolicyAction - allow deleting a policy
-	KMSDeletePolicyAction = "kms:DeletePolicy"
+	KMSDeletePolicyAction KMSAction = "kms:DeletePolicy"
 	// KMSSetPolicyAction - allow creating or updating a policy
-	KMSSetPolicyAction = "kms:SetPolicy"
+	KMSSetPolicyAction KMSAction = "kms:SetPolicy"
 	// KMSGetPolicyAction - allow getting a policy
-	KMSGetPolicyAction = "kms:GetPolicy"
+	KMSGetPolicyAction KMSAction = "kms:GetPolicy"
 	// KMSListPoliciesAction - allow getting list of KMS policies
-	KMSListPoliciesAction = "kms:ListPolicies"
+	KMSListPoliciesAction KMSAction = "kms:ListPolicies"
 	// KMSDescribeIdentityAction - allow getting KMS identity
-	KMSDescribeIdentityAction = "kms:DescribeIdentity"
+	KMSDescribeIdentityAction KMSAction = "kms:DescribeIdentity"
 	// KMSDescribeSelfIdentityAction - allow getting self KMS identity
-	KMSDescribeSelfIdentityAction = "kms:DescribeSelfIdentity"
+	KMSDescribeSelfIdentityAction KMSAction = "kms:DescribeSelfIdentity"
 	// KMSDeleteIdentityAction - allow deleting a policy
-	KMSDeleteIdentityAction = "kms:DeleteIdentity"
+	KMSDeleteIdentityAction KMSAction = "kms:DeleteIdentity"
 	// KMSListIdentitiesAction - allow getting list of KMS identities
-	KMSListIdentitiesAction = "kms:ListIdentities"
+	KMSListIdentitiesAction KMSAction = "kms:ListIdentities"
 	// KMSKeyStatusAction - allow getting KMS key status
-	KMSKeyStatusAction = "kms:KeyStatus"
+	KMSKeyStatusAction KMSAction = "kms:KeyStatus"
 	// KMSStatusAction - allow getting KMS status
-	KMSStatusAction = "kms:Status"
+	KMSStatusAction KMSAction = "kms:Status"
 	// KMSAPIAction - allow getting a list of supported API endpoints
-	KMSAPIAction = "kms:API"
+	KMSAPIAction KMSAction = "kms:API"
 	// KMSMetricsAction - allow getting server metrics in the Prometheus exposition format
-	KMSMetricsAction = "kms:Metrics"
+	KMSMetricsAction KMSAction = "kms:Metrics"
 	// KMSVersionAction - allow getting version information
-	KMSVersionAction = "kms:Version"
+	KMSVersionAction KMSAction = "kms:Version"
 	// KMSAuditLogAction - subscribes to the audit log
-	KMSAuditLogAction = "kms:AuditLog"
+	KMSAuditLogAction KMSAction = "kms:AuditLog"
 	// KMSErrorLogAction - subscribes to the error log
-	KMSErrorLogAction = "kms:ErrorLog"
+	KMSErrorLogAction KMSAction = "kms:ErrorLog"
 	// AllKMSActions - provides all admin permissions
-	AllKMSActions = "kms:*"
+	AllKMSActions KMSAction = "kms:*"
 )
 
 // List of all supported admin actions.
diff --git a/policy/memory-action.go b/policy/memory-action.go
index 08c13ab..34c18db 100644
--- a/policy/memory-action.go
+++ b/policy/memory-action.go
@@ -30,31 +30,31 @@ const (
 	MemoryCreateCortexAction MemoryAction = "memory:CreateCortex"
 
 	// MemoryDeleteCortexAction - delete a Memory cortex.
-	MemoryDeleteCortexAction = "memory:DeleteCortex"
+	MemoryDeleteCortexAction MemoryAction = "memory:DeleteCortex"
 
 	// MemoryGetCortexAction - read a Memory cortex's metadata.
-	MemoryGetCortexAction = "memory:GetCortex"
+	MemoryGetCortexAction MemoryAction = "memory:GetCortex"
 
 	// MemoryListCortexesAction - list Memory cortexes.
-	MemoryListCortexesAction = "memory:ListCortexes"
+	MemoryListCortexesAction MemoryAction = "memory:ListCortexes"
 
 	// MemoryPutSecretAction - write a secret in a cortex.
-	MemoryPutSecretAction = "memory:PutSecret"
+	MemoryPutSecretAction MemoryAction = "memory:PutSecret"
 
 	// MemoryGetSecretAction - read a secret's decrypted value from a cortex.
-	MemoryGetSecretAction = "memory:GetSecret"
+	MemoryGetSecretAction MemoryAction = "memory:GetSecret"
 
 	// MemoryDeleteSecretAction - delete a secret from a cortex.
-	MemoryDeleteSecretAction = "memory:DeleteSecret"
+	MemoryDeleteSecretAction MemoryAction = "memory:DeleteSecret"
 
 	// MemoryListSecretsAction - list the secrets in a cortex.
-	MemoryListSecretsAction = "memory:ListSecrets"
+	MemoryListSecretsAction MemoryAction = "memory:ListSecrets"
 
 	// MemorySearchAction - search (corpus-grep) the objects in a cortex.
-	MemorySearchAction = "memory:Search"
+	MemorySearchAction MemoryAction = "memory:Search"
 
 	// AllMemoryActions - all AIStor Memory API actions.
-	AllMemoryActions = "memory:*"
+	AllMemoryActions MemoryAction = "memory:*"
 )
 
 // SupportedMemoryActions - list of all supported AIStor Memory API actions.
diff --git a/policy/policy_test.go b/policy/policy_test.go
index a3ef64c..bcaaf36 100644
--- a/policy/policy_test.go
+++ b/policy/policy_test.go
@@ -103,11 +103,11 @@ func TestAdminPolicyResource(t *testing.T) {
 	}
 
 	allowedActions := p.IsAllowedActions("", "", map[string][]string{})
-	if !allowedActions.Match(ListServiceAccountsAdminAction) {
+	if !allowedActions.Match(Action(ListServiceAccountsAdminAction)) {
 		t.Fatal("expected success for ListServiceAccounts, but failed to match")
 	}
 
-	if !allowedActions.Match(GetBucketQuotaAdminAction) {
+	if !allowedActions.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected success for GetBucketQuota, but failed to match")
 	}
 }
@@ -1298,7 +1298,7 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Allow,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1354,14 +1354,14 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
 			NewStatement(
 				"",
 				Allow,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1411,7 +1411,7 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1554,7 +1554,7 @@ func TestMergePolicies(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1575,7 +1575,7 @@ func TestMergePolicies(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1636,7 +1636,7 @@ func TestMergePolicies(t *testing.T) {
 					NewStatement(
 						"",
 						Deny,
-						NewActionSet(AllAdminActions),
+						NewActionSet(Action(AllAdminActions)),
 						ResourceSet{},
 						condition.NewFunctions(),
 					),
@@ -1665,7 +1665,7 @@ func TestMergePolicies(t *testing.T) {
 					NewStatement(
 						"",
 						Deny,
-						NewActionSet(AllAdminActions),
+						NewActionSet(Action(AllAdminActions)),
 						ResourceSet{},
 						condition.NewFunctions(),
 					),
@@ -2101,7 +2101,7 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
     }
   ]
 }`,
-			expectedActions:   []Action{S3TablesPutTableBucketMaintenanceConfigurationAction},
+			expectedActions:   []Action{Action(S3TablesPutTableBucketMaintenanceConfigurationAction)},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/*"},
 		},
 		{
@@ -2124,7 +2124,7 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
     }
   ]
 }`,
-			expectedActions:   []Action{S3TablesGetTableDataAction, S3TablesGetTableMetadataLocationAction},
+			expectedActions:   []Action{Action(S3TablesGetTableDataAction), Action(S3TablesGetTableMetadataLocationAction)},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/amzn-s3-demo-table-bucket/table/*"},
 			expectedCondKeys:  []condition.KeyName{condition.S3TablesNamespace},
 		},
@@ -2147,10 +2147,10 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
   ]
 }`,
 			expectedActions: []Action{
-				S3TablesDeleteTableAction,
-				S3TablesUpdateTableMetadataLocationAction,
-				S3TablesPutTableDataAction,
-				S3TablesGetTableMetadataLocationAction,
+				Action(S3TablesDeleteTableAction),
+				Action(S3TablesUpdateTableMetadataLocationAction),
+				Action(S3TablesPutTableDataAction),
+				Action(S3TablesGetTableMetadataLocationAction),
 			},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/amzn-s3-demo-bucket/table/tableUUID"},
 		},
@@ -2268,7 +2268,7 @@ func TestS3TablesActionsWithImplicitMatching(t *testing.T) {
 			name:       "GetTableData direct match",
 			policyJSON: policy1JSON,
 			args: Args{
-				Action:     S3TablesGetTableDataAction,
+				Action:     Action(S3TablesGetTableDataAction),
 				BucketName: "bucket/my-warehouse/table/table-uuid-123",
 			},
 			expectedResult: true,
@@ -2333,7 +2333,7 @@ func TestS3TablesActionsWithImplicitMatching(t *testing.T) {
 			name:       "PutTableData direct match",
 			policyJSON: policy2JSON,
 			args: Args{
-				Action:     S3TablesPutTableDataAction,
+				Action:     Action(S3TablesPutTableDataAction),
 				BucketName: "bucket/test-warehouse/table/uuid-456",
 			},
 			expectedResult: true,
@@ -2736,13 +2736,13 @@ func TestAdminActionResourceScoping(t *testing.T) {
 
 	// Matching bucket must be allowed.
 	allowed := p.IsAllowedActions("mybucket", "", map[string][]string{})
-	if !allowed.Match(GetBucketQuotaAdminAction) {
+	if !allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota allowed for mybucket")
 	}
 
 	// Different bucket must be denied.
 	allowed = p.IsAllowedActions("otherbucket", "", map[string][]string{})
-	if allowed.Match(GetBucketQuotaAdminAction) {
+	if allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota denied for otherbucket")
 	}
 
@@ -2761,7 +2761,7 @@ func TestAdminActionResourceScoping(t *testing.T) {
 		t.Fatal(err)
 	}
 	allowed = p.IsAllowedActions("", "", map[string][]string{})
-	if !allowed.Match(ServerInfoAdminAction) {
+	if !allowed.Match(Action(ServerInfoAdminAction)) {
 		t.Fatal("expected ServerInfo allowed without resource")
 	}
 
@@ -2780,10 +2780,10 @@ func TestAdminActionResourceScoping(t *testing.T) {
 		t.Fatal(err)
 	}
 	allowed = p.IsAllowedActions("", "", map[string][]string{})
-	if !allowed.Match(ServerInfoAdminAction) {
+	if !allowed.Match(Action(ServerInfoAdminAction)) {
 		t.Fatal("expected ServerInfo allowed with admin:* and no resource")
 	}
-	if !allowed.Match(GetBucketQuotaAdminAction) {
+	if !allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota allowed with admin:* and no resource constraint")
 	}
 }
diff --git a/policy/statement_test.go b/policy/statement_test.go
index 9e16d2a..d4aa605 100644
--- a/policy/statement_test.go
+++ b/policy/statement_test.go
@@ -329,13 +329,13 @@ func TestStatementIsValid(t *testing.T) {
 		), false},
 		{NewStatement("",
 			Allow,
-			NewActionSet(CreateUserAdminAction, DeleteUserAdminAction),
+			NewActionSet(Action(CreateUserAdminAction), Action(DeleteUserAdminAction)),
 			nil,
 			condition.NewFunctions(func2, func3),
 		), true},
 		{NewStatement("",
 			Allow,
-			NewActionSet(CreateUserAdminAction, DeleteUserAdminAction),
+			NewActionSet(Action(CreateUserAdminAction), Action(DeleteUserAdminAction)),
 			nil,
 			condition.NewFunctions(),
 		), false},
diff --git a/policy/sts-action.go b/policy/sts-action.go
index 37a59f5..62fc99e 100644
--- a/policy/sts-action.go
+++ b/policy/sts-action.go
@@ -26,25 +26,25 @@ type STSAction string
 
 const (
 	// AssumeRoleAction - use to deny or allow sts:AssumeRole action under specific conditions.
-	AssumeRoleAction = "sts:AssumeRole"
+	AssumeRoleAction STSAction = "sts:AssumeRole"
 
 	// AssumeRoleLDAPIdentityAction - use to deny or allow sts:AssumeRoleLDAPIdentity action under specific conditions.
-	AssumeRoleLDAPIdentityAction = "sts:AssumeRoleLDAPIdentity"
+	AssumeRoleLDAPIdentityAction STSAction = "sts:AssumeRoleLDAPIdentity"
 
 	// AssumeRoleWithCustomTokenAction - use to deny or allow sts:AssumeRoleWithCustomToken action under specific conditions.
-	AssumeRoleWithCustomTokenAction = "sts:AssumeRoleWithCustomToken"
+	AssumeRoleWithCustomTokenAction STSAction = "sts:AssumeRoleWithCustomToken"
 
 	// AssumeRoleWithWebIdentityAction - use to deny or allow sts:AssumeRoleWithWebIdentity action under specific conditions.
-	AssumeRoleWithWebIdentityAction = "sts:AssumeRoleWithWebIdentity"
+	AssumeRoleWithWebIdentityAction STSAction = "sts:AssumeRoleWithWebIdentity"
 
 	// AssumeRoleWithClientGrantsAction - use to deny or allow sts:AssumeRoleWithClientGrants action under specific conditions.
-	AssumeRoleWithClientGrantsAction = "sts:AssumeRoleWithClientGrants"
+	AssumeRoleWithClientGrantsAction STSAction = "sts:AssumeRoleWithClientGrants"
 
 	// AssumeRoleWithClientCertificateAction - use to deny or allow sts:AssumeRoleWithClientCertificate action under specific conditions.
-	AssumeRoleWithClientCertificateAction = "sts:AssumeRoleWithClientCertificate"
+	AssumeRoleWithClientCertificateAction STSAction = "sts:AssumeRoleWithClientCertificate"
 
 	// AllSTSActions - select all STS actions
-	AllSTSActions = "sts:*"
+	AllSTSActions STSAction = "sts:*"
 )
 
 // List of all supported sts actions.
@@ -71,13 +71,13 @@ func createSTSActionConditionKeyMap() map[Action]condition.KeySet {
 	}
 
 	return ActionConditionKeyMap{
-		AllSTSActions:                         condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleAction:                      condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleLDAPIdentityAction:          condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithWebIdentityAction:       condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithCustomTokenAction:       condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithClientGrantsAction:      condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithClientCertificateAction: condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AllSTSActions):                         condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleAction):                      condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleLDAPIdentityAction):          condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithWebIdentityAction):       condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithCustomTokenAction):       condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithClientGrantsAction):      condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithClientCertificateAction): condition.NewKeySet(allSupportedSTSKeys...),
 	}
 }
 
diff --git a/policy/table-action.go b/policy/table-action.go
index 0c61f72..1855cec 100644
--- a/policy/table-action.go
+++ b/policy/table-action.go
@@ -26,225 +26,225 @@ type TableAction string
 
 const (
 	// S3TablesCreateNamespaceAction maps to the AWS `CreateNamespace` S3 Tables action.
-	S3TablesCreateNamespaceAction = "s3tables:CreateNamespace"
+	S3TablesCreateNamespaceAction TableAction = "s3tables:CreateNamespace"
 
 	// S3TablesCreateTableAction maps to the AWS `CreateTable` S3 Tables action.
-	S3TablesCreateTableAction = "s3tables:CreateTable"
+	S3TablesCreateTableAction TableAction = "s3tables:CreateTable"
 
 	// S3TablesDeleteNamespaceAction maps to the AWS `DeleteNamespace` S3 Tables action.
-	S3TablesDeleteNamespaceAction = "s3tables:DeleteNamespace"
+	S3TablesDeleteNamespaceAction TableAction = "s3tables:DeleteNamespace"
 
 	// S3TablesDeleteTableAction maps to the AWS `DeleteTable` S3 Tables action.
-	S3TablesDeleteTableAction = "s3tables:DeleteTable"
+	S3TablesDeleteTableAction TableAction = "s3tables:DeleteTable"
 
 	// S3TablesDeleteTablePolicyAction maps to the AWS `DeleteTablePolicy` S3 Tables action.
-	S3TablesDeleteTablePolicyAction = "s3tables:DeleteTablePolicy"
+	S3TablesDeleteTablePolicyAction TableAction = "s3tables:DeleteTablePolicy"
 
 	// S3TablesGetNamespaceAction maps to the AWS `GetNamespace` S3 Tables action.
-	S3TablesGetNamespaceAction = "s3tables:GetNamespace"
+	S3TablesGetNamespaceAction TableAction = "s3tables:GetNamespace"
 
 	// S3TablesGetTableAction maps to the AWS `GetTable` S3 Tables action.
-	S3TablesGetTableAction = "s3tables:GetTable"
+	S3TablesGetTableAction TableAction = "s3tables:GetTable"
 
 	// S3TablesGetTableDataAction maps to the AWS `GetTableData` S3 Tables action.
-	S3TablesGetTableDataAction = "s3tables:GetTableData"
+	S3TablesGetTableDataAction TableAction = "s3tables:GetTableData"
 
 	// S3TablesGetTableEncryptionAction maps to the AWS `GetTableEncryption` S3 Tables action.
-	S3TablesGetTableEncryptionAction = "s3tables:GetTableEncryption"
+	S3TablesGetTableEncryptionAction TableAction = "s3tables:GetTableEncryption"
 
 	// S3TablesGetTableMaintenanceConfigurationAction maps to the AWS `GetTableMaintenanceConfiguration` S3 Tables action.
-	S3TablesGetTableMaintenanceConfigurationAction = "s3tables:GetTableMaintenanceConfiguration"
+	S3TablesGetTableMaintenanceConfigurationAction TableAction = "s3tables:GetTableMaintenanceConfiguration"
 
 	// S3TablesGetTableMaintenanceJobStatusAction maps to the AWS `GetTableMaintenanceJobStatus` S3 Tables action.
-	S3TablesGetTableMaintenanceJobStatusAction = "s3tables:GetTableMaintenanceJobStatus"
+	S3TablesGetTableMaintenanceJobStatusAction TableAction = "s3tables:GetTableMaintenanceJobStatus"
 
 	// S3TablesGetTableMetadataLocationAction maps to the AWS `GetTableMetadataLocation` S3 Tables action.
-	S3TablesGetTableMetadataLocationAction = "s3tables:GetTableMetadataLocation"
+	S3TablesGetTableMetadataLocationAction TableAction = "s3tables:GetTableMetadataLocation"
 
 	// S3TablesGetTablePolicyAction maps to the AWS `GetTablePolicy` S3 Tables action.
-	S3TablesGetTablePolicyAction = "s3tables:GetTablePolicy"
+	S3TablesGetTablePolicyAction TableAction = "s3tables:GetTablePolicy"
 
 	// S3TablesListNamespacesAction maps to the AWS `ListNamespaces` S3 Tables action.
-	S3TablesListNamespacesAction = "s3tables:ListNamespaces"
+	S3TablesListNamespacesAction TableAction = "s3tables:ListNamespaces"
 
 	// S3TablesListTablesAction maps to the AWS `ListTables` S3 Tables action.
-	S3TablesListTablesAction = "s3tables:ListTables"
+	S3TablesListTablesAction TableAction = "s3tables:ListTables"
 
 	// S3TablesPutTableDataAction maps to the AWS `PutTableData` S3 Tables action.
-	S3TablesPutTableDataAction = "s3tables:PutTableData"
+	S3TablesPutTableDataAction TableAction = "s3tables:PutTableData"
 
 	// S3TablesPutTableEncryptionAction maps to the AWS `PutTableEncryption` S3 Tables action.
-	S3TablesPutTableEncryptionAction = "s3tables:PutTableEncryption"
+	S3TablesPutTableEncryptionAction TableAction = "s3tables:PutTableEncryption"
 
 	// S3TablesPutTableMaintenanceConfigurationAction maps to the AWS `PutTableMaintenanceConfiguration` S3 Tables action.
-	S3TablesPutTableMaintenanceConfigurationAction = "s3tables:PutTableMaintenanceConfiguration"
+	S3TablesPutTableMaintenanceConfigurationAction TableAction = "s3tables:PutTableMaintenanceConfiguration"
 
 	// S3TablesPutTablePolicyAction maps to the AWS `PutTablePolicy` S3 Tables action.
-	S3TablesPutTablePolicyAction = "s3tables:PutTablePolicy"
+	S3TablesPutTablePolicyAction TableAction = "s3tables:PutTablePolicy"
 
 	// S3TablesRegisterTableAction maps to the AWS `RegisterTable` S3 Tables action.
-	S3TablesRegisterTableAction = "s3tables:RegisterTable"
+	S3TablesRegisterTableAction TableAction = "s3tables:RegisterTable"
 
 	// S3TablesRenameTableAction maps to the AWS `RenameTable` S3 Tables action.
-	S3TablesRenameTableAction = "s3tables:RenameTable"
+	S3TablesRenameTableAction TableAction = "s3tables:RenameTable"
 
 	// S3TablesUpdateTableMetadataLocationAction maps to the AWS `UpdateTableMetadataLocation` S3 Tables action.
-	S3TablesUpdateTableMetadataLocationAction = "s3tables:UpdateTableMetadataLocation"
+	S3TablesUpdateTableMetadataLocationAction TableAction = "s3tables:UpdateTableMetadataLocation"
 
 	// S3TablesCreateWarehouseAction is a MinIO extension for Iceberg warehouse provisioning.
-	S3TablesCreateWarehouseAction = "s3tables:CreateWarehouse"
+	S3TablesCreateWarehouseAction TableAction = "s3tables:CreateWarehouse"
 
 	// S3TablesCreateTableBucketAction maps to the AWS `CreateTableBucket` S3 Tables action.
 	// Prefer using S3TablesCreateWarehouseAction instead.
-	S3TablesCreateTableBucketAction = "s3tables:CreateTableBucket"
+	S3TablesCreateTableBucketAction TableAction = "s3tables:CreateTableBucket"
 
 	// S3TablesDeleteWarehouseAction is a MinIO extension for deleting Iceberg warehouses.
-	S3TablesDeleteWarehouseAction = "s3tables:DeleteWarehouse"
+	S3TablesDeleteWarehouseAction TableAction = "s3tables:DeleteWarehouse"
 
 	// S3TablesDeleteTableBucketAction maps to the AWS `DeleteTableBucket` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehouseAction instead.
-	S3TablesDeleteTableBucketAction = "s3tables:DeleteTableBucket"
+	S3TablesDeleteTableBucketAction TableAction = "s3tables:DeleteTableBucket"
 
 	// S3TablesDeleteWarehouseEncryptionAction is a MinIO extension for deleting warehouse encryption configuration.
-	S3TablesDeleteWarehouseEncryptionAction = "s3tables:DeleteWarehouseEncryption"
+	S3TablesDeleteWarehouseEncryptionAction TableAction = "s3tables:DeleteWarehouseEncryption"
 
 	// S3TablesDeleteTableBucketEncryptionAction maps to the AWS `DeleteTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehouseEncryptionAction instead.
-	S3TablesDeleteTableBucketEncryptionAction = "s3tables:DeleteTableBucketEncryption"
+	S3TablesDeleteTableBucketEncryptionAction TableAction = "s3tables:DeleteTableBucketEncryption"
 
 	// S3TablesDeleteWarehousePolicyAction is a MinIO extension for deleting warehouse policies.
-	S3TablesDeleteWarehousePolicyAction = "s3tables:DeleteWarehousePolicy"
+	S3TablesDeleteWarehousePolicyAction TableAction = "s3tables:DeleteWarehousePolicy"
 
 	// S3TablesDeleteTableBucketPolicyAction maps to the AWS `DeleteTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehousePolicyAction instead.
-	S3TablesDeleteTableBucketPolicyAction = "s3tables:DeleteTableBucketPolicy"
+	S3TablesDeleteTableBucketPolicyAction TableAction = "s3tables:DeleteTableBucketPolicy"
 
 	// S3TablesGetWarehouseAction is a MinIO extension for retrieving warehouse details.
-	S3TablesGetWarehouseAction = "s3tables:GetWarehouse"
+	S3TablesGetWarehouseAction TableAction = "s3tables:GetWarehouse"
 
 	// S3TablesGetTableBucketAction maps to the AWS `GetTableBucket` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseAction instead.
-	S3TablesGetTableBucketAction = "s3tables:GetTableBucket"
+	S3TablesGetTableBucketAction TableAction = "s3tables:GetTableBucket"
 
 	// S3TablesGetWarehouseEncryptionAction is a MinIO extension for retrieving warehouse encryption configuration.
-	S3TablesGetWarehouseEncryptionAction = "s3tables:GetWarehouseEncryption"
+	S3TablesGetWarehouseEncryptionAction TableAction = "s3tables:GetWarehouseEncryption"
 
 	// S3TablesGetTableBucketEncryptionAction maps to the AWS `GetTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseEncryptionAction instead.
-	S3TablesGetTableBucketEncryptionAction = "s3tables:GetTableBucketEncryption"
+	S3TablesGetTableBucketEncryptionAction TableAction = "s3tables:GetTableBucketEncryption"
 
 	// S3TablesGetWarehouseMaintenanceConfigurationAction is a MinIO extension for retrieving warehouse maintenance configuration.
-	S3TablesGetWarehouseMaintenanceConfigurationAction = "s3tables:GetWarehouseMaintenanceConfiguration"
+	S3TablesGetWarehouseMaintenanceConfigurationAction TableAction = "s3tables:GetWarehouseMaintenanceConfiguration"
 
 	// S3TablesGetTableBucketMaintenanceConfigurationAction maps to the AWS `GetTableBucketMaintenanceConfiguration` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseMaintenanceConfigurationAction instead.
-	S3TablesGetTableBucketMaintenanceConfigurationAction = "s3tables:GetTableBucketMaintenanceConfiguration"
+	S3TablesGetTableBucketMaintenanceConfigurationAction TableAction = "s3tables:GetTableBucketMaintenanceConfiguration"
 
 	// S3TablesGetWarehousePolicyAction is a MinIO extension for retrieving warehouse policies.
-	S3TablesGetWarehousePolicyAction = "s3tables:GetWarehousePolicy"
+	S3TablesGetWarehousePolicyAction TableAction = "s3tables:GetWarehousePolicy"
 
 	// S3TablesGetTableBucketPolicyAction maps to the AWS `GetTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesGetWarehousePolicyAction instead.
-	S3TablesGetTableBucketPolicyAction = "s3tables:GetTableBucketPolicy"
+	S3TablesGetTableBucketPolicyAction TableAction = "s3tables:GetTableBucketPolicy"
 
 	// S3TablesListWarehousesAction is a MinIO extension for listing Iceberg warehouses.
-	S3TablesListWarehousesAction = "s3tables:ListWarehouses"
+	S3TablesListWarehousesAction TableAction = "s3tables:ListWarehouses"
 
 	// S3TablesListTableBucketsAction maps to the AWS `ListTableBuckets` S3 Tables action.
 	// Prefer using S3TablesListWarehousesAction instead.
-	S3TablesListTableBucketsAction = "s3tables:ListTableBuckets"
+	S3TablesListTableBucketsAction TableAction = "s3tables:ListTableBuckets"
 
 	// S3TablesPutWarehouseEncryptionAction is a MinIO extension for setting warehouse encryption configuration.
-	S3TablesPutWarehouseEncryptionAction = "s3tables:PutWarehouseEncryption"
+	S3TablesPutWarehouseEncryptionAction TableAction = "s3tables:PutWarehouseEncryption"
 
 	// S3TablesPutTableBucketEncryptionAction maps to the AWS `PutTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesPutWarehouseEncryptionAction instead.
-	S3TablesPutTableBucketEncryptionAction = "s3tables:PutTableBucketEncryption"
+	S3TablesPutTableBucketEncryptionAction TableAction = "s3tables:PutTableBucketEncryption"
 
 	// S3TablesPutWarehouseMaintenanceConfigurationAction is a MinIO extension for setting warehouse maintenance configuration.
-	S3TablesPutWarehouseMaintenanceConfigurationAction = "s3tables:PutWarehouseMaintenanceConfiguration"
+	S3TablesPutWarehouseMaintenanceConfigurationAction TableAction = "s3tables:PutWarehouseMaintenanceConfiguration"
 
 	// S3TablesPutTableBucketMaintenanceConfigurationAction maps to the AWS `PutTableBucketMaintenanceConfiguration` S3 Tables action.
 	// Prefer using S3TablesPutWarehouseMaintenanceConfigurationAction instead.
-	S3TablesPutTableBucketMaintenanceConfigurationAction = "s3tables:PutTableBucketMaintenanceConfiguration"
+	S3TablesPutTableBucketMaintenanceConfigurationAction TableAction = "s3tables:PutTableBucketMaintenanceConfiguration"
 
 	// S3TablesPutWarehousePolicyAction is a MinIO extension for setting warehouse policies.
-	S3TablesPutWarehousePolicyAction = "s3tables:PutWarehousePolicy"
+	S3TablesPutWarehousePolicyAction TableAction = "s3tables:PutWarehousePolicy"
 
 	// S3TablesPutTableBucketPolicyAction maps to the AWS `PutTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesPutWarehousePolicyAction instead.
-	S3TablesPutTableBucketPolicyAction = "s3tables:PutTableBucketPolicy"
+	S3TablesPutTableBucketPolicyAction TableAction = "s3tables:PutTableBucketPolicy"
 
 	// S3TablesGetConfigAction is a MinIO extension for retrieving catalog configuration.
-	S3TablesGetConfigAction = "s3tables:GetConfig"
+	S3TablesGetConfigAction TableAction = "s3tables:GetConfig"
 
 	// S3TablesTableMetricsAction is a MinIO extension exposing table metrics.
-	S3TablesTableMetricsAction = "s3tables:TableMetrics"
+	S3TablesTableMetricsAction TableAction = "s3tables:TableMetrics"
 
 	// S3TablesUpdateTableAction is a MinIO extension for Iceberg-compatible table updates.
-	S3TablesUpdateTableAction = "s3tables:UpdateTable"
+	S3TablesUpdateTableAction TableAction = "s3tables:UpdateTable"
 
 	// S3TablesCreateViewAction is a MinIO extension for creating Iceberg views.
-	S3TablesCreateViewAction = "s3tables:CreateView"
+	S3TablesCreateViewAction TableAction = "s3tables:CreateView"
 
 	// S3TablesDeleteViewAction is a MinIO extension for deleting Iceberg views.
-	S3TablesDeleteViewAction = "s3tables:DeleteView"
+	S3TablesDeleteViewAction TableAction = "s3tables:DeleteView"
 
 	// S3TablesGetViewAction is a MinIO extension for retrieving Iceberg views.
-	S3TablesGetViewAction = "s3tables:GetView"
+	S3TablesGetViewAction TableAction = "s3tables:GetView"
 
 	// S3TablesRenameViewAction is a MinIO extension for renaming Iceberg views.
-	S3TablesRenameViewAction = "s3tables:RenameView"
+	S3TablesRenameViewAction TableAction = "s3tables:RenameView"
 
 	// S3TablesUpdateViewAction is a MinIO extension for updating Iceberg views.
-	S3TablesUpdateViewAction = "s3tables:UpdateView"
+	S3TablesUpdateViewAction TableAction = "s3tables:UpdateView"
 
 	// S3TablesListViewsAction is a MinIO extension for listing Iceberg views.
-	S3TablesListViewsAction = "s3tables:ListViews"
+	S3TablesListViewsAction TableAction = "s3tables:ListViews"
 
 	// S3TablesRegisterViewAction is a MinIO extension for registering Iceberg views.
-	S3TablesRegisterViewAction = "s3tables:RegisterView"
+	S3TablesRegisterViewAction TableAction = "s3tables:RegisterView"
 
 	// S3TablesCreateFunctionAction is a MinIO extension for creating Iceberg functions (SQL UDFs).
-	S3TablesCreateFunctionAction = "s3tables:CreateFunction"
+	S3TablesCreateFunctionAction TableAction = "s3tables:CreateFunction"
 
 	// S3TablesDeleteFunctionAction is a MinIO extension for deleting Iceberg functions (SQL UDFs).
-	S3TablesDeleteFunctionAction = "s3tables:DeleteFunction"
+	S3TablesDeleteFunctionAction TableAction = "s3tables:DeleteFunction"
 
 	// S3TablesGetFunctionAction is a MinIO extension for retrieving Iceberg functions (SQL UDFs).
-	S3TablesGetFunctionAction = "s3tables:GetFunction"
+	S3TablesGetFunctionAction TableAction = "s3tables:GetFunction"
 
 	// S3TablesRenameFunctionAction is a MinIO extension for renaming Iceberg functions (SQL UDFs).
-	S3TablesRenameFunctionAction = "s3tables:RenameFunction"
+	S3TablesRenameFunctionAction TableAction = "s3tables:RenameFunction"
 
 	// S3TablesUpdateFunctionAction is a MinIO extension for updating Iceberg functions (SQL UDFs).
-	S3TablesUpdateFunctionAction = "s3tables:UpdateFunction"
+	S3TablesUpdateFunctionAction TableAction = "s3tables:UpdateFunction"
 
 	// S3TablesListFunctionsAction is a MinIO extension for listing Iceberg functions (SQL UDFs).
-	S3TablesListFunctionsAction = "s3tables:ListFunctions"
+	S3TablesListFunctionsAction TableAction = "s3tables:ListFunctions"
 
 	// S3TablesRegisterFunctionAction is a MinIO extension for registering Iceberg functions (SQL UDFs).
-	S3TablesRegisterFunctionAction = "s3tables:RegisterFunction"
+	S3TablesRegisterFunctionAction TableAction = "s3tables:RegisterFunction"
 
 	// S3TablesUpdateNamespacePropertiesAction is a MinIO extension for updating namespace properties.
-	S3TablesUpdateNamespacePropertiesAction = "s3tables:UpdateNamespaceProperties"
+	S3TablesUpdateNamespacePropertiesAction TableAction = "s3tables:UpdateNamespaceProperties"
 
 	// S3TablesTagWarehouseAction is a MinIO extension for tagging Iceberg warehouses.
-	S3TablesTagWarehouseAction = "s3tables:TagWarehouse"
+	S3TablesTagWarehouseAction TableAction = "s3tables:TagWarehouse"
 	// S3TablesUntagWarehouseAction is a MinIO extension for removing tags from Iceberg warehouses.
-	S3TablesUntagWarehouseAction = "s3tables:UntagWarehouse"
+	S3TablesUntagWarehouseAction TableAction = "s3tables:UntagWarehouse"
 	// S3TablesListTagsForWarehouseAction is a MinIO extension for listing tags on Iceberg warehouses.
-	S3TablesListTagsForWarehouseAction = "s3tables:ListTagsForWarehouse"
+	S3TablesListTagsForWarehouseAction TableAction = "s3tables:ListTagsForWarehouse"
 
 	// S3TablesTagTableAction is a MinIO extension for tagging tables.
-	S3TablesTagTableAction = "s3tables:TagTable"
+	S3TablesTagTableAction TableAction = "s3tables:TagTable"
 	// S3TablesUntagTableAction is a MinIO extension for removing tags from tables.
-	S3TablesUntagTableAction = "s3tables:UntagTable"
+	S3TablesUntagTableAction TableAction = "s3tables:UntagTable"
 	// S3TablesListTagsForTableAction is a MinIO extension for listing tags on tables.
-	S3TablesListTagsForTableAction = "s3tables:ListTagsForTable"
+	S3TablesListTagsForTableAction TableAction = "s3tables:ListTagsForTable"
 
 	// AllS3TablesActions - all Amazon S3 Tables actions
-	AllS3TablesActions = "s3tables:*"
+	AllS3TablesActions TableAction = "s3tables:*"
 )
 
 // SupportedTableActions - list of all supported S3 Tables actions.
@@ -382,7 +382,7 @@ func createTableActionConditionKeyMap() map[Action]condition.KeySet {
 	}
 
 	// Override specific actions with their condition keys
-	tableActionConditionKeyMap[AllS3TablesActions] = withCommon(
+	tableActionConditionKeyMap[Action(AllS3TablesActions)] = withCommon(
 		s3TablesNamespaceKey,
 		s3TablesTableNameKey,
 		s3TablesViewNameKey,
@@ -393,76 +393,76 @@ func createTableActionConditionKeyMap() map[Action]condition.KeySet {
 		s3TablesWarehouseTagKey,
 		s3TablesTableTagKey,
 	)
-	tableActionConditionKeyMap[S3TablesCreateNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesCreateTableAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesTableNameKey, s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesCreateTableBucketAction] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesDeleteNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesDeleteTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesGetTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableDataAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableEncryptionAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMaintenanceConfigurationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMaintenanceJobStatusAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMetadataLocationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesListNamespacesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesListTableBucketsAction] = withCommon()
-	tableActionConditionKeyMap[S3TablesListTablesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesPutTableBucketEncryptionAction] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutTableBucketMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutTableDataAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesPutTableEncryptionAction] = withTableCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutTableMaintenanceConfigurationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesPutTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesRegisterTableAction] = withTableCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesRenameTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUpdateTableMetadataLocationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesCreateWarehouseAction] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesDeleteWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteWarehouseEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesListWarehousesAction] = withCommon()
-	tableActionConditionKeyMap[S3TablesPutWarehouseEncryptionAction] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutWarehouseMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetConfigAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesTableMetricsAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUpdateTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesCreateViewAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesViewNameKey)
-	tableActionConditionKeyMap[S3TablesDeleteViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesGetViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesRenameViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesUpdateViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesRegisterViewAction] = withViewCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesListViewsAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesCreateFunctionAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesFunctionNameKey)
-	tableActionConditionKeyMap[S3TablesDeleteFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesGetFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesRenameFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesUpdateFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesRegisterFunctionAction] = withFunctionCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesListFunctionsAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesUpdateNamespacePropertiesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesTagWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesUntagWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesListTagsForWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesTagTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUntagTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesListTagsForTableAction] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateTableAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesTableNameKey, s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateTableBucketAction)] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesGetTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableDataAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableEncryptionAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMaintenanceConfigurationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMaintenanceJobStatusAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMetadataLocationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesListNamespacesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesListTableBucketsAction)] = withCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTablesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketEncryptionAction)] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableDataAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableEncryptionAction)] = withTableCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableMaintenanceConfigurationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterTableAction)] = withTableCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesRenameTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateTableMetadataLocationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateWarehouseAction)] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehouseEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesListWarehousesAction)] = withCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutWarehouseEncryptionAction)] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutWarehouseMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetConfigAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesTableMetricsAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateViewAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesViewNameKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesRenameViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterViewAction)] = withViewCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesListViewsAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateFunctionAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesFunctionNameKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesRenameFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterFunctionAction)] = withFunctionCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesListFunctionsAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesUpdateNamespacePropertiesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesTagWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesUntagWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTagsForWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesTagTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUntagTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTagsForTableAction)] = withTableCommon()
 
 	return tableActionConditionKeyMap
 }
diff --git a/policy/vectors-action.go b/policy/vectors-action.go
index e6fd61d..aa72357 100644
--- a/policy/vectors-action.go
+++ b/policy/vectors-action.go
@@ -29,43 +29,43 @@ const (
 	S3VectorsCreateVectorBucketAction VectorsAction = "s3vectors:CreateVectorBucket"
 
 	// S3VectorsDeleteVectorBucketAction maps to the AWS `DeleteVectorBucket` S3 Vectors action.
-	S3VectorsDeleteVectorBucketAction = "s3vectors:DeleteVectorBucket"
+	S3VectorsDeleteVectorBucketAction VectorsAction = "s3vectors:DeleteVectorBucket"
 
 	// S3VectorsGetVectorBucketAction maps to the AWS `GetVectorBucket` S3 Vectors action.
-	S3VectorsGetVectorBucketAction = "s3vectors:GetVectorBucket"
+	S3VectorsGetVectorBucketAction VectorsAction = "s3vectors:GetVectorBucket"
 
 	// S3VectorsListVectorBucketsAction maps to the AWS `ListVectorBuckets` S3 Vectors action.
-	S3VectorsListVectorBucketsAction = "s3vectors:ListVectorBuckets"
+	S3VectorsListVectorBucketsAction VectorsAction = "s3vectors:ListVectorBuckets"
 
 	// S3VectorsCreateIndexAction maps to the AWS `CreateIndex` S3 Vectors action.
-	S3VectorsCreateIndexAction = "s3vectors:CreateIndex"
+	S3VectorsCreateIndexAction VectorsAction = "s3vectors:CreateIndex"
 
 	// S3VectorsDeleteIndexAction maps to the AWS `DeleteIndex` S3 Vectors action.
-	S3VectorsDeleteIndexAction = "s3vectors:DeleteIndex"
+	S3VectorsDeleteIndexAction VectorsAction = "s3vectors:DeleteIndex"
 
 	// S3VectorsGetIndexAction maps to the AWS `GetIndex` S3 Vectors action.
-	S3VectorsGetIndexAction = "s3vectors:GetIndex"
+	S3VectorsGetIndexAction VectorsAction = "s3vectors:GetIndex"
 
 	// S3VectorsListIndexesAction maps to the AWS `ListIndexes` S3 Vectors action.
-	S3VectorsListIndexesAction = "s3vectors:ListIndexes"
+	S3VectorsListIndexesAction VectorsAction = "s3vectors:ListIndexes"
 
 	// S3VectorsPutVectorsAction maps to the AWS `PutVectors` S3 Vectors action.
-	S3VectorsPutVectorsAction = "s3vectors:PutVectors"
+	S3VectorsPutVectorsAction VectorsAction = "s3vectors:PutVectors"
 
 	// S3VectorsGetVectorsAction maps to the AWS `GetVectors` S3 Vectors action.
-	S3VectorsGetVectorsAction = "s3vectors:GetVectors"
+	S3VectorsGetVectorsAction VectorsAction = "s3vectors:GetVectors"
 
 	// S3VectorsDeleteVectorsAction maps to the AWS `DeleteVectors` S3 Vectors action.
-	S3VectorsDeleteVectorsAction = "s3vectors:DeleteVectors"
+	S3VectorsDeleteVectorsAction VectorsAction = "s3vectors:DeleteVectors"
 
 	// S3VectorsListVectorsAction maps to the AWS `ListVectors` S3 Vectors action.
-	S3VectorsListVectorsAction = "s3vectors:ListVectors"
+	S3VectorsListVectorsAction VectorsAction = "s3vectors:ListVectors"
 
 	// S3VectorsQueryVectorsAction maps to the AWS `QueryVectors` S3 Vectors action.
-	S3VectorsQueryVectorsAction = "s3vectors:QueryVectors"
+	S3VectorsQueryVectorsAction VectorsAction = "s3vectors:QueryVectors"
 
 	// AllS3VectorsActions - all Amazon S3 Vectors actions
-	AllS3VectorsActions = "s3vectors:*"
+	AllS3VectorsActions VectorsAction = "s3vectors:*"
 )
 
 // SupportedVectorsActions - list of all supported S3 Vectors actions.