From d6571cf6d6ab4510edbf4a7ea883c882270decbd Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Thu, 16 Jul 2026 12:19:44 -0700
Subject: [PATCH] feat: type all policy action constants by service
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Give every policy action constant its proper service type (Action,
AdminAction, STSAction, KMSAction, TableAction, VectorsAction,
MemoryAction) instead of an untyped string. This lets generic helpers
constrained by ActionType accept any typed action via inference (an
untyped string constant would otherwise infer as `string`, which the
union rejects).

Where the base Action-keyed engine aggregates heterogeneous actions —
the predefined policies in constants.go, implicitActions, and the
per-service condition-key maps — the typed constants are converted
explicitly with Action(...). No behavior change; go build, go vet, and
go test ./policy/... pass.
---
 policy/action.go         | 142 ++++++++--------
 policy/actionset.go      |  58 +++----
 policy/actionset_test.go |   2 +-
 policy/admin-action.go   | 210 ++++++++++++------------
 policy/constants.go      | 346 +++++++++++++++++++--------------------
 policy/constants_test.go |   4 +-
 policy/kms-action.go     |  44 ++---
 policy/memory-action.go  |  18 +-
 policy/policy_test.go    |  46 +++---
 policy/statement_test.go |   4 +-
 policy/sts-action.go     |  28 ++--
 policy/table-action.go   | 284 ++++++++++++++++----------------
 policy/vectors-action.go |  26 +--
 13 files changed, 606 insertions(+), 606 deletions(-)

diff --git a/policy/action.go b/policy/action.go
index edd0bf7f..4a26b5df 100644
--- a/policy/action.go
+++ b/policy/action.go
@@ -32,219 +32,219 @@ const (
 	AbortMultipartUploadAction Action = "s3:AbortMultipartUpload"
 
 	// CreateBucketAction - CreateBucket Rest API action.
-	CreateBucketAction = "s3:CreateBucket"
+	CreateBucketAction Action = "s3:CreateBucket"
 
 	// DeleteBucketAction - DeleteBucket Rest API action.
-	DeleteBucketAction = "s3:DeleteBucket"
+	DeleteBucketAction Action = "s3:DeleteBucket"
 
 	// ForceDeleteBucketAction - DeleteBucket Rest API action when x-minio-force-delete flag
 	// is specified.
-	ForceDeleteBucketAction = "s3:ForceDeleteBucket"
+	ForceDeleteBucketAction Action = "s3:ForceDeleteBucket"
 
 	// DeleteBucketPolicyAction - DeleteBucketPolicy Rest API action.
-	DeleteBucketPolicyAction = "s3:DeleteBucketPolicy"
+	DeleteBucketPolicyAction Action = "s3:DeleteBucketPolicy"
 
 	// DeleteBucketCorsAction - DeleteBucketCors Rest API action.
-	DeleteBucketCorsAction = "s3:DeleteBucketCors"
+	DeleteBucketCorsAction Action = "s3:DeleteBucketCors"
 
 	// DeleteObjectAction - DeleteObject Rest API action.
-	DeleteObjectAction = "s3:DeleteObject"
+	DeleteObjectAction Action = "s3:DeleteObject"
 
 	// GetBucketLocationAction - GetBucketLocation Rest API action.
-	GetBucketLocationAction = "s3:GetBucketLocation"
+	GetBucketLocationAction Action = "s3:GetBucketLocation"
 
 	// GetBucketNotificationAction - GetBucketNotification Rest API action.
-	GetBucketNotificationAction = "s3:GetBucketNotification"
+	GetBucketNotificationAction Action = "s3:GetBucketNotification"
 
 	// GetBucketPolicyAction - GetBucketPolicy Rest API action.
-	GetBucketPolicyAction = "s3:GetBucketPolicy"
+	GetBucketPolicyAction Action = "s3:GetBucketPolicy"
 
 	// GetBucketCorsAction - GetBucketCors Rest API action.
-	GetBucketCorsAction = "s3:GetBucketCors"
+	GetBucketCorsAction Action = "s3:GetBucketCors"
 
 	// GetObjectAction - GetObject Rest API action.
-	GetObjectAction = "s3:GetObject"
+	GetObjectAction Action = "s3:GetObject"
 
 	// GetObjectAttributesAction - GetObjectVersionAttributes Rest API action.
-	GetObjectAttributesAction = "s3:GetObjectAttributes"
+	GetObjectAttributesAction Action = "s3:GetObjectAttributes"
 
 	// HeadBucketAction - HeadBucket Rest API action. This action is unused in minio.
-	HeadBucketAction = "s3:HeadBucket"
+	HeadBucketAction Action = "s3:HeadBucket"
 
 	// ListAllMyBucketsAction - ListAllMyBuckets (List buckets) Rest API action.
-	ListAllMyBucketsAction = "s3:ListAllMyBuckets"
+	ListAllMyBucketsAction Action = "s3:ListAllMyBuckets"
 
 	// ListBucketAction - ListBucket Rest API action.
-	ListBucketAction = "s3:ListBucket"
+	ListBucketAction Action = "s3:ListBucket"
 
 	// GetBucketPolicyStatusAction - Retrieves the policy status for a bucket.
-	GetBucketPolicyStatusAction = "s3:GetBucketPolicyStatus"
+	GetBucketPolicyStatusAction Action = "s3:GetBucketPolicyStatus"
 
 	// ListBucketVersionsAction - ListBucketVersions Rest API action.
-	ListBucketVersionsAction = "s3:ListBucketVersions"
+	ListBucketVersionsAction Action = "s3:ListBucketVersions"
 
 	// ListBucketMultipartUploadsAction - ListMultipartUploads Rest API action.
-	ListBucketMultipartUploadsAction = "s3:ListBucketMultipartUploads"
+	ListBucketMultipartUploadsAction Action = "s3:ListBucketMultipartUploads"
 
 	// ListenNotificationAction - ListenNotification Rest API action.
 	// This is MinIO extension.
-	ListenNotificationAction = "s3:ListenNotification"
+	ListenNotificationAction Action = "s3:ListenNotification"
 
 	// ListenBucketNotificationAction - ListenBucketNotification Rest API action.
 	// This is MinIO extension.
-	ListenBucketNotificationAction = "s3:ListenBucketNotification"
+	ListenBucketNotificationAction Action = "s3:ListenBucketNotification"
 
 	// ListMultipartUploadPartsAction - ListParts Rest API action.
-	ListMultipartUploadPartsAction = "s3:ListMultipartUploadParts"
+	ListMultipartUploadPartsAction Action = "s3:ListMultipartUploadParts"
 
 	// PutBucketLifecycleAction - PutBucketLifecycle Rest API action.
-	PutBucketLifecycleAction = "s3:PutLifecycleConfiguration"
+	PutBucketLifecycleAction Action = "s3:PutLifecycleConfiguration"
 
 	// GetBucketLifecycleAction - GetBucketLifecycle Rest API action.
-	GetBucketLifecycleAction = "s3:GetLifecycleConfiguration"
+	GetBucketLifecycleAction Action = "s3:GetLifecycleConfiguration"
 
 	// PutBucketNotificationAction - PutObjectNotification Rest API action.
-	PutBucketNotificationAction = "s3:PutBucketNotification"
+	PutBucketNotificationAction Action = "s3:PutBucketNotification"
 
 	// PutBucketPolicyAction - PutBucketPolicy Rest API action.
-	PutBucketPolicyAction = "s3:PutBucketPolicy"
+	PutBucketPolicyAction Action = "s3:PutBucketPolicy"
 
 	// PutBucketCorsAction - PutBucketCors Rest API action.
-	PutBucketCorsAction = "s3:PutBucketCors"
+	PutBucketCorsAction Action = "s3:PutBucketCors"
 
 	//  PutBucketQOSAction - allow set QOS configuration
-	PutBucketQOSAction = "s3:PutBucketQOS"
+	PutBucketQOSAction Action = "s3:PutBucketQOS"
 
 	//  GetBucketQOSAction - allow get QOS configuration
-	GetBucketQOSAction = "s3:GetBucketQOS"
+	GetBucketQOSAction Action = "s3:GetBucketQOS"
 
 	// PutObjectAction - PutObject Rest API action.
-	PutObjectAction = "s3:PutObject"
+	PutObjectAction Action = "s3:PutObject"
 
 	// DeleteObjectVersionAction - DeleteObjectVersion Rest API action.
-	DeleteObjectVersionAction = "s3:DeleteObjectVersion"
+	DeleteObjectVersionAction Action = "s3:DeleteObjectVersion"
 
 	// DeleteObjectVersionTaggingAction - DeleteObjectVersionTagging Rest API action.
-	DeleteObjectVersionTaggingAction = "s3:DeleteObjectVersionTagging"
+	DeleteObjectVersionTaggingAction Action = "s3:DeleteObjectVersionTagging"
 
 	// GetObjectVersionAction - GetObjectVersionAction Rest API action.
-	GetObjectVersionAction = "s3:GetObjectVersion"
+	GetObjectVersionAction Action = "s3:GetObjectVersion"
 
 	// GetObjectVersionAttributesAction - GetObjectVersionAttributes Rest API action.
-	GetObjectVersionAttributesAction = "s3:GetObjectVersionAttributes"
+	GetObjectVersionAttributesAction Action = "s3:GetObjectVersionAttributes"
 
 	// GetObjectVersionTaggingAction - GetObjectVersionTagging Rest API action.
-	GetObjectVersionTaggingAction = "s3:GetObjectVersionTagging"
+	GetObjectVersionTaggingAction Action = "s3:GetObjectVersionTagging"
 
 	// PutObjectVersionTaggingAction - PutObjectVersionTagging Rest API action.
-	PutObjectVersionTaggingAction = "s3:PutObjectVersionTagging"
+	PutObjectVersionTaggingAction Action = "s3:PutObjectVersionTagging"
 
 	// BypassGovernanceRetentionAction - bypass governance retention for PutObjectRetention, PutObject and DeleteObject Rest API action.
-	BypassGovernanceRetentionAction = "s3:BypassGovernanceRetention"
+	BypassGovernanceRetentionAction Action = "s3:BypassGovernanceRetention"
 
 	// PutObjectRetentionAction - PutObjectRetention Rest API action.
-	PutObjectRetentionAction = "s3:PutObjectRetention"
+	PutObjectRetentionAction Action = "s3:PutObjectRetention"
 
 	// GetObjectRetentionAction - GetObjectRetention, GetObject, HeadObject Rest API action.
-	GetObjectRetentionAction = "s3:GetObjectRetention"
+	GetObjectRetentionAction Action = "s3:GetObjectRetention"
 
 	// GetObjectLegalHoldAction - GetObjectLegalHold, GetObject Rest API action.
-	GetObjectLegalHoldAction = "s3:GetObjectLegalHold"
+	GetObjectLegalHoldAction Action = "s3:GetObjectLegalHold"
 
 	// PutObjectLegalHoldAction - PutObjectLegalHold, PutObject Rest API action.
-	PutObjectLegalHoldAction = "s3:PutObjectLegalHold"
+	PutObjectLegalHoldAction Action = "s3:PutObjectLegalHold"
 
 	// GetBucketObjectLockConfigurationAction - GetBucketObjectLockConfiguration Rest API action
-	GetBucketObjectLockConfigurationAction = "s3:GetBucketObjectLockConfiguration"
+	GetBucketObjectLockConfigurationAction Action = "s3:GetBucketObjectLockConfiguration"
 
 	// PutBucketObjectLockConfigurationAction - PutBucketObjectLockConfiguration Rest API action
-	PutBucketObjectLockConfigurationAction = "s3:PutBucketObjectLockConfiguration"
+	PutBucketObjectLockConfigurationAction Action = "s3:PutBucketObjectLockConfiguration"
 
 	// GetBucketTaggingAction - GetBucketTagging Rest API action
-	GetBucketTaggingAction = "s3:GetBucketTagging"
+	GetBucketTaggingAction Action = "s3:GetBucketTagging"
 
 	// PutBucketTaggingAction - PutBucketTagging Rest API action
-	PutBucketTaggingAction = "s3:PutBucketTagging"
+	PutBucketTaggingAction Action = "s3:PutBucketTagging"
 
 	// GetObjectTaggingAction - Get Object Tags API action
-	GetObjectTaggingAction = "s3:GetObjectTagging"
+	GetObjectTaggingAction Action = "s3:GetObjectTagging"
 
 	// PutObjectTaggingAction - Put Object Tags API action
-	PutObjectTaggingAction = "s3:PutObjectTagging"
+	PutObjectTaggingAction Action = "s3:PutObjectTagging"
 
 	// DeleteObjectTaggingAction - Delete Object Tags API action
-	DeleteObjectTaggingAction = "s3:DeleteObjectTagging"
+	DeleteObjectTaggingAction Action = "s3:DeleteObjectTagging"
 
 	// PutObjectAnnotationAction - PutObjectAnnotation API action
-	PutObjectAnnotationAction = "s3:PutObjectAnnotation"
+	PutObjectAnnotationAction Action = "s3:PutObjectAnnotation"
 
 	// GetObjectAnnotationAction - GetObjectAnnotation API action
-	GetObjectAnnotationAction = "s3:GetObjectAnnotation"
+	GetObjectAnnotationAction Action = "s3:GetObjectAnnotation"
 
 	// DeleteObjectAnnotationAction - DeleteObjectAnnotation API action
-	DeleteObjectAnnotationAction = "s3:DeleteObjectAnnotation"
+	DeleteObjectAnnotationAction Action = "s3:DeleteObjectAnnotation"
 
 	// ListObjectAnnotationsAction - ListObjectAnnotations API action
-	ListObjectAnnotationsAction = "s3:ListObjectAnnotations"
+	ListObjectAnnotationsAction Action = "s3:ListObjectAnnotations"
 
 	// UpdateObjectEncryptionAction - UpdateObjectEncryption REST API action
-	UpdateObjectEncryptionAction = "s3:UpdateObjectEncryption"
+	UpdateObjectEncryptionAction Action = "s3:UpdateObjectEncryption"
 
 	// PutBucketEncryptionAction - PutBucketEncryption REST API action
-	PutBucketEncryptionAction = "s3:PutEncryptionConfiguration"
+	PutBucketEncryptionAction Action = "s3:PutEncryptionConfiguration"
 
 	// GetBucketEncryptionAction - GetBucketEncryption REST API action
-	GetBucketEncryptionAction = "s3:GetEncryptionConfiguration"
+	GetBucketEncryptionAction Action = "s3:GetEncryptionConfiguration"
 
 	// PutBucketVersioningAction - PutBucketVersioning REST API action
-	PutBucketVersioningAction = "s3:PutBucketVersioning"
+	PutBucketVersioningAction Action = "s3:PutBucketVersioning"
 
 	// GetBucketVersioningAction - GetBucketVersioning REST API action
-	GetBucketVersioningAction = "s3:GetBucketVersioning"
+	GetBucketVersioningAction Action = "s3:GetBucketVersioning"
 	// GetReplicationConfigurationAction  - GetReplicationConfiguration REST API action
-	GetReplicationConfigurationAction = "s3:GetReplicationConfiguration"
+	GetReplicationConfigurationAction Action = "s3:GetReplicationConfiguration"
 	// PutReplicationConfigurationAction  - PutReplicationConfiguration REST API action
-	PutReplicationConfigurationAction = "s3:PutReplicationConfiguration"
+	PutReplicationConfigurationAction Action = "s3:PutReplicationConfiguration"
 
 	// ReplicateObjectAction  - ReplicateObject REST API action
-	ReplicateObjectAction = "s3:ReplicateObject"
+	ReplicateObjectAction Action = "s3:ReplicateObject"
 
 	// ReplicateDeleteAction  - ReplicateDelete REST API action
-	ReplicateDeleteAction = "s3:ReplicateDelete"
+	ReplicateDeleteAction Action = "s3:ReplicateDelete"
 
 	// ReplicateTagsAction  - ReplicateTags REST API action
-	ReplicateTagsAction = "s3:ReplicateTags"
+	ReplicateTagsAction Action = "s3:ReplicateTags"
 
 	// GetObjectVersionForReplicationAction  - GetObjectVersionForReplication REST API action
-	GetObjectVersionForReplicationAction = "s3:GetObjectVersionForReplication"
+	GetObjectVersionForReplicationAction Action = "s3:GetObjectVersionForReplication"
 
 	// ReplicateObjectAnnotationAction - ReplicateObjectAnnotation REST API action
-	ReplicateObjectAnnotationAction = "s3:ReplicateObjectAnnotation"
+	ReplicateObjectAnnotationAction Action = "s3:ReplicateObjectAnnotation"
 
 	// GetObjectVersionAnnotationForReplicationAction - GetObjectVersionAnnotationForReplication REST API action
-	GetObjectVersionAnnotationForReplicationAction = "s3:GetObjectVersionAnnotationForReplication"
+	GetObjectVersionAnnotationForReplicationAction Action = "s3:GetObjectVersionAnnotationForReplication"
 
 	// RestoreObjectAction - RestoreObject REST API action
-	RestoreObjectAction = "s3:RestoreObject"
+	RestoreObjectAction Action = "s3:RestoreObject"
 	// ResetBucketReplicationStateAction - MinIO extension API ResetBucketReplicationState to reset replication state
 	// on a bucket
-	ResetBucketReplicationStateAction = "s3:ResetBucketReplicationState"
+	ResetBucketReplicationStateAction Action = "s3:ResetBucketReplicationState"
 
 	// PutObjectFanOutAction - PutObject like API action but allows PostUpload() fan-out.
-	PutObjectFanOutAction = "s3:PutObjectFanOut"
+	PutObjectFanOutAction Action = "s3:PutObjectFanOut"
 
 	// Inventory configuration actions
 
 	// PutInventoryConfigurationAction - Bucket inventory write operations actions
-	PutInventoryConfigurationAction = "s3:PutInventoryConfiguration"
+	PutInventoryConfigurationAction Action = "s3:PutInventoryConfiguration"
 	// GetInventoryConfigurationAction - Bucket inventory read operations actions
-	GetInventoryConfigurationAction = "s3:GetInventoryConfiguration"
+	GetInventoryConfigurationAction Action = "s3:GetInventoryConfiguration"
 
 	// CreateSessionAction - S3Express REST API action
-	CreateSessionAction = "s3express:CreateSession"
+	CreateSessionAction Action = "s3express:CreateSession"
 
 	// AllActions - all API actions
-	AllActions = "s3:*"
+	AllActions Action = "s3:*"
 )
 
 // SupportedActions - list of all supported actions.
diff --git a/policy/actionset.go b/policy/actionset.go
index 525f6eac..930ca9d8 100644
--- a/policy/actionset.go
+++ b/policy/actionset.go
@@ -53,44 +53,44 @@ var implicitActions = map[Action]ActionSet{
 	GetObjectVersionAction: NewActionSet(GetObjectAction),
 
 	// S3Tables actions implicitly allow their data actions
-	S3TablesGetTableDataAction: NewActionSet(GetObjectAction, ListMultipartUploadPartsAction),
-	S3TablesPutTableDataAction: NewActionSet(PutObjectAction, AbortMultipartUploadAction, ListBucketAction),
-	// S3TablesDeleteTableAction implicitly allows DeleteObjectAction to support table purging.
+	Action(S3TablesGetTableDataAction): NewActionSet(GetObjectAction, ListMultipartUploadPartsAction),
+	Action(S3TablesPutTableDataAction): NewActionSet(PutObjectAction, AbortMultipartUploadAction, ListBucketAction),
+	// Action(S3TablesDeleteTableAction) implicitly allows DeleteObjectAction to support table purging.
 	// This is needed because Spark's DROP TABLE ... PURGE performs client-side deletes rather than
 	// using purgeRequested=true to let the catalog handle deletion. This workaround grants the
 	// necessary privilege until the issue is fixed in Spark/Iceberg upstream.
 	// See: https://github.com/apache/iceberg/issues/14743
 	//      https://github.com/apache/iceberg/issues/11023
-	S3TablesDeleteTableAction: NewActionSet(DeleteObjectAction),
-	AllS3TablesActions:        NewActionSet(GetObjectAction, PutObjectAction, DeleteObjectAction, ListBucketAction, ListMultipartUploadPartsAction, AbortMultipartUploadAction),
+	Action(S3TablesDeleteTableAction): NewActionSet(DeleteObjectAction),
+	Action(AllS3TablesActions):        NewActionSet(GetObjectAction, PutObjectAction, DeleteObjectAction, ListBucketAction, ListMultipartUploadPartsAction, AbortMultipartUploadAction),
 
 	// TableBucket actions implicitly allow their Warehouse counterparts
-	S3TablesCreateTableBucketAction:                      NewActionSet(S3TablesCreateWarehouseAction),
-	S3TablesDeleteTableBucketAction:                      NewActionSet(S3TablesDeleteWarehouseAction),
-	S3TablesDeleteTableBucketEncryptionAction:            NewActionSet(S3TablesDeleteWarehouseEncryptionAction),
-	S3TablesDeleteTableBucketPolicyAction:                NewActionSet(S3TablesDeleteWarehousePolicyAction),
-	S3TablesGetTableBucketAction:                         NewActionSet(S3TablesGetWarehouseAction),
-	S3TablesGetTableBucketEncryptionAction:               NewActionSet(S3TablesGetWarehouseEncryptionAction),
-	S3TablesGetTableBucketMaintenanceConfigurationAction: NewActionSet(S3TablesGetWarehouseMaintenanceConfigurationAction),
-	S3TablesGetTableBucketPolicyAction:                   NewActionSet(S3TablesGetWarehousePolicyAction),
-	S3TablesListTableBucketsAction:                       NewActionSet(S3TablesListWarehousesAction),
-	S3TablesPutTableBucketEncryptionAction:               NewActionSet(S3TablesPutWarehouseEncryptionAction),
-	S3TablesPutTableBucketMaintenanceConfigurationAction: NewActionSet(S3TablesPutWarehouseMaintenanceConfigurationAction),
-	S3TablesPutTableBucketPolicyAction:                   NewActionSet(S3TablesPutWarehousePolicyAction),
+	Action(S3TablesCreateTableBucketAction):                      NewActionSet(Action(S3TablesCreateWarehouseAction)),
+	Action(S3TablesDeleteTableBucketAction):                      NewActionSet(Action(S3TablesDeleteWarehouseAction)),
+	Action(S3TablesDeleteTableBucketEncryptionAction):            NewActionSet(Action(S3TablesDeleteWarehouseEncryptionAction)),
+	Action(S3TablesDeleteTableBucketPolicyAction):                NewActionSet(Action(S3TablesDeleteWarehousePolicyAction)),
+	Action(S3TablesGetTableBucketAction):                         NewActionSet(Action(S3TablesGetWarehouseAction)),
+	Action(S3TablesGetTableBucketEncryptionAction):               NewActionSet(Action(S3TablesGetWarehouseEncryptionAction)),
+	Action(S3TablesGetTableBucketMaintenanceConfigurationAction): NewActionSet(Action(S3TablesGetWarehouseMaintenanceConfigurationAction)),
+	Action(S3TablesGetTableBucketPolicyAction):                   NewActionSet(Action(S3TablesGetWarehousePolicyAction)),
+	Action(S3TablesListTableBucketsAction):                       NewActionSet(Action(S3TablesListWarehousesAction)),
+	Action(S3TablesPutTableBucketEncryptionAction):               NewActionSet(Action(S3TablesPutWarehouseEncryptionAction)),
+	Action(S3TablesPutTableBucketMaintenanceConfigurationAction): NewActionSet(Action(S3TablesPutWarehouseMaintenanceConfigurationAction)),
+	Action(S3TablesPutTableBucketPolicyAction):                   NewActionSet(Action(S3TablesPutWarehousePolicyAction)),
 
 	// Warehouse actions implicitly allow their TableBucket counterparts
-	S3TablesCreateWarehouseAction:                      NewActionSet(S3TablesCreateTableBucketAction),
-	S3TablesDeleteWarehouseAction:                      NewActionSet(S3TablesDeleteTableBucketAction),
-	S3TablesDeleteWarehouseEncryptionAction:            NewActionSet(S3TablesDeleteTableBucketEncryptionAction),
-	S3TablesDeleteWarehousePolicyAction:                NewActionSet(S3TablesDeleteTableBucketPolicyAction),
-	S3TablesGetWarehouseAction:                         NewActionSet(S3TablesGetTableBucketAction),
-	S3TablesGetWarehouseEncryptionAction:               NewActionSet(S3TablesGetTableBucketEncryptionAction),
-	S3TablesGetWarehouseMaintenanceConfigurationAction: NewActionSet(S3TablesGetTableBucketMaintenanceConfigurationAction),
-	S3TablesGetWarehousePolicyAction:                   NewActionSet(S3TablesGetTableBucketPolicyAction),
-	S3TablesListWarehousesAction:                       NewActionSet(S3TablesListTableBucketsAction),
-	S3TablesPutWarehouseEncryptionAction:               NewActionSet(S3TablesPutTableBucketEncryptionAction),
-	S3TablesPutWarehouseMaintenanceConfigurationAction: NewActionSet(S3TablesPutTableBucketMaintenanceConfigurationAction),
-	S3TablesPutWarehousePolicyAction:                   NewActionSet(S3TablesPutTableBucketPolicyAction),
+	Action(S3TablesCreateWarehouseAction):                      NewActionSet(Action(S3TablesCreateTableBucketAction)),
+	Action(S3TablesDeleteWarehouseAction):                      NewActionSet(Action(S3TablesDeleteTableBucketAction)),
+	Action(S3TablesDeleteWarehouseEncryptionAction):            NewActionSet(Action(S3TablesDeleteTableBucketEncryptionAction)),
+	Action(S3TablesDeleteWarehousePolicyAction):                NewActionSet(Action(S3TablesDeleteTableBucketPolicyAction)),
+	Action(S3TablesGetWarehouseAction):                         NewActionSet(Action(S3TablesGetTableBucketAction)),
+	Action(S3TablesGetWarehouseEncryptionAction):               NewActionSet(Action(S3TablesGetTableBucketEncryptionAction)),
+	Action(S3TablesGetWarehouseMaintenanceConfigurationAction): NewActionSet(Action(S3TablesGetTableBucketMaintenanceConfigurationAction)),
+	Action(S3TablesGetWarehousePolicyAction):                   NewActionSet(Action(S3TablesGetTableBucketPolicyAction)),
+	Action(S3TablesListWarehousesAction):                       NewActionSet(Action(S3TablesListTableBucketsAction)),
+	Action(S3TablesPutWarehouseEncryptionAction):               NewActionSet(Action(S3TablesPutTableBucketEncryptionAction)),
+	Action(S3TablesPutWarehouseMaintenanceConfigurationAction): NewActionSet(Action(S3TablesPutTableBucketMaintenanceConfigurationAction)),
+	Action(S3TablesPutWarehousePolicyAction):                   NewActionSet(Action(S3TablesPutTableBucketPolicyAction)),
 }
 
 // Match - matches object name with anyone of action pattern in action set.
diff --git a/policy/actionset_test.go b/policy/actionset_test.go
index 03560efd..bc55bbc7 100644
--- a/policy/actionset_test.go
+++ b/policy/actionset_test.go
@@ -49,7 +49,7 @@ func TestActionSetMatches(t *testing.T) {
 		expectedResult bool
 	}{
 		{NewActionSet(AllActions), AbortMultipartUploadAction, true},
-		{NewActionSet(AllS3TablesActions), S3TablesCreateTableAction, true},
+		{NewActionSet(Action(AllS3TablesActions)), Action(S3TablesCreateTableAction), true},
 		{NewActionSet(PutObjectAction), PutObjectAction, true},
 		{NewActionSet(PutObjectAction, GetObjectAction), PutObjectAction, true},
 		{NewActionSet(PutObjectAction, GetObjectAction), AbortMultipartUploadAction, false},
diff --git a/policy/admin-action.go b/policy/admin-action.go
index 462687e8..c7c013bd 100644
--- a/policy/admin-action.go
+++ b/policy/admin-action.go
@@ -27,291 +27,291 @@ type AdminAction string
 
 const (
 	// HealAdminAction - allows heal command
-	HealAdminAction = "admin:Heal"
+	HealAdminAction AdminAction = "admin:Heal"
 
 	// DecommissionAdminAction - allows decomissioning of pools
-	DecommissionAdminAction = "admin:Decommission"
+	DecommissionAdminAction AdminAction = "admin:Decommission"
 
 	// RebalanceAdminAction - allows rebalancing of pools
-	RebalanceAdminAction = "admin:Rebalance"
+	RebalanceAdminAction AdminAction = "admin:Rebalance"
 	// Service Actions
 
 	// StorageInfoAdminAction - allow listing server info
-	StorageInfoAdminAction = "admin:StorageInfo"
+	StorageInfoAdminAction AdminAction = "admin:StorageInfo"
 	// PrometheusAdminAction - prometheus info action
-	PrometheusAdminAction = "admin:Prometheus"
+	PrometheusAdminAction AdminAction = "admin:Prometheus"
 	// DataUsageInfoAdminAction - allow listing data usage info
-	DataUsageInfoAdminAction = "admin:DataUsageInfo"
+	DataUsageInfoAdminAction AdminAction = "admin:DataUsageInfo"
 	// ForceUnlockAdminAction - allow force unlocking locks
-	ForceUnlockAdminAction = "admin:ForceUnlock"
+	ForceUnlockAdminAction AdminAction = "admin:ForceUnlock"
 	// TopLocksAdminAction - allow listing top locks
-	TopLocksAdminAction = "admin:TopLocksInfo"
+	TopLocksAdminAction AdminAction = "admin:TopLocksInfo"
 	// ProfilingAdminAction - allow profiling
-	ProfilingAdminAction = "admin:Profiling"
+	ProfilingAdminAction AdminAction = "admin:Profiling"
 	// TraceAdminAction - allow listing server trace
-	TraceAdminAction = "admin:ServerTrace"
+	TraceAdminAction AdminAction = "admin:ServerTrace"
 	// ConsoleLogAdminAction - allow listing console logs on terminal
-	ConsoleLogAdminAction = "admin:ConsoleLog"
+	ConsoleLogAdminAction AdminAction = "admin:ConsoleLog"
 	// KMSEnableAdminAction - allow enabling the builtin KMS
-	KMSEnableAdminAction = "admin:KMSEnable"
+	KMSEnableAdminAction AdminAction = "admin:KMSEnable"
 	// KMSBackupAdminAction - allow backing up builtin KMS keys
-	KMSBackupAdminAction = "admin:KMSBackup"
+	KMSBackupAdminAction AdminAction = "admin:KMSBackup"
 	// KMSRestoreAdminAction - allow restoring builtin KMS keys
-	KMSRestoreAdminAction = "admin:KMSRestore"
+	KMSRestoreAdminAction AdminAction = "admin:KMSRestore"
 	// KMSCreateKeyAdminAction - allow creating a new KMS master key
-	KMSCreateKeyAdminAction = "admin:KMSCreateKey"
+	KMSCreateKeyAdminAction AdminAction = "admin:KMSCreateKey"
 	// KMSKeyStatusAdminAction - allow getting KMS key status
-	KMSKeyStatusAdminAction = "admin:KMSKeyStatus"
+	KMSKeyStatusAdminAction AdminAction = "admin:KMSKeyStatus"
 	// KMSKeyRotateAdminAction - allow rotating KMS keys
-	KMSKeyRotateAdminAction = "admin:KMSKeyRotate"
+	KMSKeyRotateAdminAction AdminAction = "admin:KMSKeyRotate"
 	// ServerInfoAdminAction - allow listing server info
-	ServerInfoAdminAction = "admin:ServerInfo"
+	ServerInfoAdminAction AdminAction = "admin:ServerInfo"
 	// HealthInfoAdminAction - allow obtaining cluster health information
-	HealthInfoAdminAction = "admin:OBDInfo"
+	HealthInfoAdminAction AdminAction = "admin:OBDInfo"
 	// LicenseInfoAdminAction - allow obtaining license information
-	LicenseInfoAdminAction = "admin:LicenseInfo"
+	LicenseInfoAdminAction AdminAction = "admin:LicenseInfo"
 	// BandwidthMonitorAction - allow monitoring bandwidth usage
-	BandwidthMonitorAction = "admin:BandwidthMonitor"
+	BandwidthMonitorAction AdminAction = "admin:BandwidthMonitor"
 	// InspectDataAction - allows downloading raw files from backend
-	InspectDataAction = "admin:InspectData"
+	InspectDataAction AdminAction = "admin:InspectData"
 
 	// ServerUpdateAdminAction - allow MinIO binary update
-	ServerUpdateAdminAction = "admin:ServerUpdate"
+	ServerUpdateAdminAction AdminAction = "admin:ServerUpdate"
 	// ServiceRestartAdminAction - allow restart of MinIO service.
-	ServiceRestartAdminAction = "admin:ServiceRestart"
+	ServiceRestartAdminAction AdminAction = "admin:ServiceRestart"
 	// ServiceStopAdminAction - allow stopping MinIO service.
-	ServiceStopAdminAction = "admin:ServiceStop"
+	ServiceStopAdminAction AdminAction = "admin:ServiceStop"
 	// ServiceFreezeAdminAction - allow freeze/unfreeze MinIO service.
-	ServiceFreezeAdminAction = "admin:ServiceFreeze"
+	ServiceFreezeAdminAction AdminAction = "admin:ServiceFreeze"
 	// ServiceCordonAdminAction - allow cordon/uncordon MinIO service.
-	ServiceCordonAdminAction = "admin:ServiceCordon"
+	ServiceCordonAdminAction AdminAction = "admin:ServiceCordon"
 
 	// ConfigUpdateAdminAction - allow MinIO config management
-	ConfigUpdateAdminAction = "admin:ConfigUpdate"
+	ConfigUpdateAdminAction AdminAction = "admin:ConfigUpdate"
 
 	// CreateUserAdminAction - allow creating MinIO user
-	CreateUserAdminAction = "admin:CreateUser"
+	CreateUserAdminAction AdminAction = "admin:CreateUser"
 	// DeleteUserAdminAction - allow deleting MinIO user
-	DeleteUserAdminAction = "admin:DeleteUser"
+	DeleteUserAdminAction AdminAction = "admin:DeleteUser"
 	// ListUsersAdminAction - allow list users permission
-	ListUsersAdminAction = "admin:ListUsers"
+	ListUsersAdminAction AdminAction = "admin:ListUsers"
 	// EnableUserAdminAction - allow enable user permission
-	EnableUserAdminAction = "admin:EnableUser"
+	EnableUserAdminAction AdminAction = "admin:EnableUser"
 	// DisableUserAdminAction - allow disable user permission
-	DisableUserAdminAction = "admin:DisableUser"
+	DisableUserAdminAction AdminAction = "admin:DisableUser"
 	// GetUserAdminAction - allows GET permission on user info
-	GetUserAdminAction = "admin:GetUser"
+	GetUserAdminAction AdminAction = "admin:GetUser"
 	// ChangeMyPasswordAdminAction - allow changing own password
-	ChangeMyPasswordAdminAction = "admin:ChangeMyPassword"
+	ChangeMyPasswordAdminAction AdminAction = "admin:ChangeMyPassword"
 
 	// Cluster Replicate Actions
 
 	// SiteReplicationAddAction - allow adding clusters for site-level replication
-	SiteReplicationAddAction = "admin:SiteReplicationAdd"
+	SiteReplicationAddAction AdminAction = "admin:SiteReplicationAdd"
 	// SiteReplicationDisableAction - allow disabling a cluster from replication
-	SiteReplicationDisableAction = "admin:SiteReplicationDisable"
+	SiteReplicationDisableAction AdminAction = "admin:SiteReplicationDisable"
 	// SiteReplicationRemoveAction - allow removing a cluster from replication
-	SiteReplicationRemoveAction = "admin:SiteReplicationRemove"
+	SiteReplicationRemoveAction AdminAction = "admin:SiteReplicationRemove"
 	// SiteReplicationResyncAction - allow resyncing cluster data to another site
-	SiteReplicationResyncAction = "admin:SiteReplicationResync"
+	SiteReplicationResyncAction AdminAction = "admin:SiteReplicationResync"
 	// SiteReplicationInfoAction - allow getting site replication info
-	SiteReplicationInfoAction = "admin:SiteReplicationInfo"
+	SiteReplicationInfoAction AdminAction = "admin:SiteReplicationInfo"
 	// SiteReplicationOperationAction - allow performing site replication
 	// create/update/delete operations to peers
-	SiteReplicationOperationAction = "admin:SiteReplicationOperation"
+	SiteReplicationOperationAction AdminAction = "admin:SiteReplicationOperation"
 
 	// Tables Replication Actions
 
 	// TablesReplicationAddAction - allow adding tables replication targets
-	TablesReplicationAddAction = "admin:TablesReplicationAdd"
+	TablesReplicationAddAction AdminAction = "admin:TablesReplicationAdd"
 	// TablesReplicationRemoveAction - allow removing tables replication targets
-	TablesReplicationRemoveAction = "admin:TablesReplicationRemove"
+	TablesReplicationRemoveAction AdminAction = "admin:TablesReplicationRemove"
 	// TablesReplicationInfoAction - allow getting tables replication info/status
-	TablesReplicationInfoAction = "admin:TablesReplicationInfo"
+	TablesReplicationInfoAction AdminAction = "admin:TablesReplicationInfo"
 	// TablesReplicationStartFailoverAction - allow starting tables replication failover
-	TablesReplicationStartFailoverAction = "admin:TablesReplicationStartFailover"
+	TablesReplicationStartFailoverAction AdminAction = "admin:TablesReplicationStartFailover"
 	// TablesReplicationCatalogAdminAction - allow catalog debugging operations (reset, dump contents)
-	TablesReplicationCatalogAdminAction = "admin:TablesReplicationCatalogAdmin"
+	TablesReplicationCatalogAdminAction AdminAction = "admin:TablesReplicationCatalogAdmin"
 
 	// Service account Actions
 
 	// CreateServiceAccountAdminAction - allow create a service account for a user
-	CreateServiceAccountAdminAction = "admin:CreateServiceAccount"
+	CreateServiceAccountAdminAction AdminAction = "admin:CreateServiceAccount"
 	// UpdateServiceAccountAdminAction - allow updating a service account
-	UpdateServiceAccountAdminAction = "admin:UpdateServiceAccount"
+	UpdateServiceAccountAdminAction AdminAction = "admin:UpdateServiceAccount"
 	// RemoveServiceAccountAdminAction - allow removing a service account
-	RemoveServiceAccountAdminAction = "admin:RemoveServiceAccount"
+	RemoveServiceAccountAdminAction AdminAction = "admin:RemoveServiceAccount"
 	// ListServiceAccountsAdminAction - allow listing service accounts
-	ListServiceAccountsAdminAction = "admin:ListServiceAccounts"
+	ListServiceAccountsAdminAction AdminAction = "admin:ListServiceAccounts"
 
 	// ListTemporaryAccountsAdminAction - allow listing of temporary accounts
-	ListTemporaryAccountsAdminAction = "admin:ListTemporaryAccounts"
+	ListTemporaryAccountsAdminAction AdminAction = "admin:ListTemporaryAccounts"
 
 	// Group Actions
 
 	// AddUserToGroupAdminAction - allow adding user to group permission
-	AddUserToGroupAdminAction = "admin:AddUserToGroup"
+	AddUserToGroupAdminAction AdminAction = "admin:AddUserToGroup"
 	// RemoveUserFromGroupAdminAction - allow removing user to group permission
-	RemoveUserFromGroupAdminAction = "admin:RemoveUserFromGroup"
+	RemoveUserFromGroupAdminAction AdminAction = "admin:RemoveUserFromGroup"
 	// GetGroupAdminAction - allow getting group info
-	GetGroupAdminAction = "admin:GetGroup"
+	GetGroupAdminAction AdminAction = "admin:GetGroup"
 	// ListGroupsAdminAction - allow list groups permission
-	ListGroupsAdminAction = "admin:ListGroups"
+	ListGroupsAdminAction AdminAction = "admin:ListGroups"
 	// EnableGroupAdminAction - allow enable group permission
-	EnableGroupAdminAction = "admin:EnableGroup"
+	EnableGroupAdminAction AdminAction = "admin:EnableGroup"
 	// DisableGroupAdminAction - allow disable group permission
-	DisableGroupAdminAction = "admin:DisableGroup"
+	DisableGroupAdminAction AdminAction = "admin:DisableGroup"
 
 	// Policy Actions
 
 	// CreatePolicyAdminAction - allow create policy permission
-	CreatePolicyAdminAction = "admin:CreatePolicy"
+	CreatePolicyAdminAction AdminAction = "admin:CreatePolicy"
 	// DeletePolicyAdminAction - allow delete policy permission
-	DeletePolicyAdminAction = "admin:DeletePolicy"
+	DeletePolicyAdminAction AdminAction = "admin:DeletePolicy"
 	// GetPolicyAdminAction - allow get policy permission
-	GetPolicyAdminAction = "admin:GetPolicy"
+	GetPolicyAdminAction AdminAction = "admin:GetPolicy"
 	// AttachPolicyAdminAction - allows attaching a policy to a user/group
-	AttachPolicyAdminAction = "admin:AttachUserOrGroupPolicy"
+	AttachPolicyAdminAction AdminAction = "admin:AttachUserOrGroupPolicy"
 	// UpdatePolicyAssociationAction - allows to add/remove policy association
 	// on a user or group.
-	UpdatePolicyAssociationAction = "admin:UpdatePolicyAssociation"
+	UpdatePolicyAssociationAction AdminAction = "admin:UpdatePolicyAssociation"
 	// ListUserPoliciesAdminAction - allows listing user policies
-	ListUserPoliciesAdminAction = "admin:ListUserPolicies"
+	ListUserPoliciesAdminAction AdminAction = "admin:ListUserPolicies"
 
 	// Bucket quota Actions
 
 	// SetBucketQuotaAdminAction - allow setting bucket quota
-	SetBucketQuotaAdminAction = "admin:SetBucketQuota"
+	SetBucketQuotaAdminAction AdminAction = "admin:SetBucketQuota"
 	// GetBucketQuotaAdminAction - allow getting bucket quota
-	GetBucketQuotaAdminAction = "admin:GetBucketQuota"
+	GetBucketQuotaAdminAction AdminAction = "admin:GetBucketQuota"
 
 	// Bucket compression Actions
 
 	// SetBucketCompressionAdminAction - allow setting per-bucket compression config
-	SetBucketCompressionAdminAction = "admin:SetBucketCompression"
+	SetBucketCompressionAdminAction AdminAction = "admin:SetBucketCompression"
 	// GetBucketCompressionAdminAction - allow getting per-bucket compression config
-	GetBucketCompressionAdminAction = "admin:GetBucketCompression"
+	GetBucketCompressionAdminAction AdminAction = "admin:GetBucketCompression"
 
 	// Bucket Target admin Actions
 
 	// SetBucketTargetAction - allow setting bucket target
-	SetBucketTargetAction = "admin:SetBucketTarget"
+	SetBucketTargetAction AdminAction = "admin:SetBucketTarget"
 	// GetBucketTargetAction - allow getting bucket targets
-	GetBucketTargetAction = "admin:GetBucketTarget"
+	GetBucketTargetAction AdminAction = "admin:GetBucketTarget"
 
 	// ReplicationDiff - allow computing the unreplicated objects in a bucket
-	ReplicationDiff = "admin:ReplicationDiff"
+	ReplicationDiff AdminAction = "admin:ReplicationDiff"
 
 	// Bucket import/export admin Actions
 
 	// ImportBucketMetadataAction - allow importing bucket metadata
-	ImportBucketMetadataAction = "admin:ImportBucketMetadata"
+	ImportBucketMetadataAction AdminAction = "admin:ImportBucketMetadata"
 	// ExportBucketMetadataAction - allow exporting bucket metadata
-	ExportBucketMetadataAction = "admin:ExportBucketMetadata"
+	ExportBucketMetadataAction AdminAction = "admin:ExportBucketMetadata"
 
 	// Remote Tier admin Actions
 
 	// SetTierAction - allow adding/editing a remote tier
-	SetTierAction = "admin:SetTier"
+	SetTierAction AdminAction = "admin:SetTier"
 	// ListTierAction - allow listing remote tiers
-	ListTierAction = "admin:ListTier"
+	ListTierAction AdminAction = "admin:ListTier"
 
 	// Migrate IAM admin Actions
 
 	// ExportIAMAction - allow exporting of all IAM info
-	ExportIAMAction = "admin:ExportIAM"
+	ExportIAMAction AdminAction = "admin:ExportIAM"
 	// ImportIAMAction - allow importing IAM info to MinIO
-	ImportIAMAction = "admin:ImportIAM"
+	ImportIAMAction AdminAction = "admin:ImportIAM"
 
 	// Batch Job APIs
 
 	// ListBatchJobsAction allow listing current active jobs
-	ListBatchJobsAction = "admin:ListBatchJobs"
+	ListBatchJobsAction AdminAction = "admin:ListBatchJobs"
 
 	// DescribeBatchJobAction allow getting batch job YAML
-	DescribeBatchJobAction = "admin:DescribeBatchJob"
+	DescribeBatchJobAction AdminAction = "admin:DescribeBatchJob"
 
 	// StartBatchJobAction allow submitting a batch job
-	StartBatchJobAction = "admin:StartBatchJob"
+	StartBatchJobAction AdminAction = "admin:StartBatchJob"
 
 	// CancelBatchJobAction allow canceling a batch job
-	CancelBatchJobAction = "admin:CancelBatchJob"
+	CancelBatchJobAction AdminAction = "admin:CancelBatchJob"
 
 	// GenerateBatchJobAction allow requesting batch job templates
-	GenerateBatchJobAction = "admin:GenerateBatchJob"
+	GenerateBatchJobAction AdminAction = "admin:GenerateBatchJob"
 
 	// Distributed Job APIs
 
 	// DistJobStatusAction allow viewing status of distributed jobs
 	// (decommission and any future job type built on the same framework),
 	// regardless of which job type is being queried.
-	DistJobStatusAction = "admin:DistJobStatus"
+	DistJobStatusAction AdminAction = "admin:DistJobStatus"
 
 	// Inventory Control Actions
 
 	// InventoryControlAction - allows control of inventory jobs
-	InventoryControlAction = "admin:InventoryControl"
+	InventoryControlAction AdminAction = "admin:InventoryControl"
 
 	// All new v4 APIs
 
 	// ClusterInfoAction - allow cluster summary
-	ClusterInfoAction = "admin:ClusterInfo"
+	ClusterInfoAction AdminAction = "admin:ClusterInfo"
 
 	// PoolListAction - allow list how many pools and summary per pool
-	PoolListAction = "admin:PoolList"
+	PoolListAction AdminAction = "admin:PoolList"
 
 	// PoolInfoAction - allow pool specific summary and detail information
-	PoolInfoAction = "admin:PoolInfo"
+	PoolInfoAction AdminAction = "admin:PoolInfo"
 
 	// NodeListAction - allow listing of nodes
-	NodeListAction = "admin:NodeList"
+	NodeListAction AdminAction = "admin:NodeList"
 
 	// NodeInfoAction - allow node specific summary and detailed information
-	NodeInfoAction = "admin:NodeInfo"
+	NodeInfoAction AdminAction = "admin:NodeInfo"
 
 	// SetInfoAction - allow set specific summary and detail
-	SetInfoAction = "admin:SetInfo"
+	SetInfoAction AdminAction = "admin:SetInfo"
 
 	// DriveListAction - allow listing of drives
-	DriveListAction = "admin:DriveList"
+	DriveListAction AdminAction = "admin:DriveList"
 
 	// DriveInfoAction - allow drive specific summary and detail
-	DriveInfoAction = "admin:DriveInfo"
+	DriveInfoAction AdminAction = "admin:DriveInfo"
 
 	// Delta Sharing Actions
 
 	// DeltaSharingAdminAction - allow managing Delta Sharing shares and tokens
-	DeltaSharingAdminAction = "admin:DeltaSharing"
+	DeltaSharingAdminAction AdminAction = "admin:DeltaSharing"
 	// DeltaSharingCreateShareAction - allow creating Delta Sharing shares
-	DeltaSharingCreateShareAction = "admin:DeltaSharingCreateShare"
+	DeltaSharingCreateShareAction AdminAction = "admin:DeltaSharingCreateShare"
 	// DeltaSharingDeleteShareAction - allow deleting Delta Sharing shares
-	DeltaSharingDeleteShareAction = "admin:DeltaSharingDeleteShare"
+	DeltaSharingDeleteShareAction AdminAction = "admin:DeltaSharingDeleteShare"
 	// DeltaSharingListSharesAction - allow listing Delta Sharing shares
-	DeltaSharingListSharesAction = "admin:DeltaSharingListShares"
+	DeltaSharingListSharesAction AdminAction = "admin:DeltaSharingListShares"
 	// DeltaSharingGetShareAction - allow getting Delta Sharing share details
-	DeltaSharingGetShareAction = "admin:DeltaSharingGetShare"
+	DeltaSharingGetShareAction AdminAction = "admin:DeltaSharingGetShare"
 	// DeltaSharingUpdateShareAction - allow updating Delta Sharing shares
-	DeltaSharingUpdateShareAction = "admin:DeltaSharingUpdateShare"
+	DeltaSharingUpdateShareAction AdminAction = "admin:DeltaSharingUpdateShare"
 	// DeltaSharingCreateTokenAction - allow creating Delta Sharing tokens
-	DeltaSharingCreateTokenAction = "admin:DeltaSharingCreateToken"
+	DeltaSharingCreateTokenAction AdminAction = "admin:DeltaSharingCreateToken"
 	// DeltaSharingDeleteTokenAction - allow deleting Delta Sharing tokens
-	DeltaSharingDeleteTokenAction = "admin:DeltaSharingDeleteToken"
+	DeltaSharingDeleteTokenAction AdminAction = "admin:DeltaSharingDeleteToken"
 	// DeltaSharingListTokensAction - allow listing Delta Sharing tokens
-	DeltaSharingListTokensAction = "admin:DeltaSharingListTokens"
+	DeltaSharingListTokensAction AdminAction = "admin:DeltaSharingListTokens"
 	// ReadAlertsAction - allow reading stored alerts
-	ReadAlertsAction = "admin:ReadAlerts"
+	ReadAlertsAction AdminAction = "admin:ReadAlerts"
 
 	// Log Actions
 
 	// ReadAPILogsAction - allow reading stored API logs
-	ReadAPILogsAction = "admin:ReadAPILogs"
+	ReadAPILogsAction AdminAction = "admin:ReadAPILogs"
 	// ReadErrorLogsAction - allow reading stored error logs
-	ReadErrorLogsAction = "admin:ReadErrorLogs"
+	ReadErrorLogsAction AdminAction = "admin:ReadErrorLogs"
 	// ReadAuditLogsAction - allow reading stored audit logs
-	ReadAuditLogsAction = "admin:ReadAuditLogs"
+	ReadAuditLogsAction AdminAction = "admin:ReadAuditLogs"
 
 	// AllAdminActions - provides all admin permissions
-	AllAdminActions = "admin:*"
+	AllAdminActions AdminAction = "admin:*"
 )
 
 // SupportedAdminActions - list of all supported admin actions.
diff --git a/policy/constants.go b/policy/constants.go
index 113b4d62..9d2b6cac 100644
--- a/policy/constants.go
+++ b/policy/constants.go
@@ -63,7 +63,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:       ID(""),
 					Effect:    Deny,
-					Actions:   NewActionSet(CreateUserAdminAction),
+					Actions:   NewActionSet(Action(CreateUserAdminAction)),
 					Resources: NewResourceSet(NewResource("*")),
 				},
 			},
@@ -85,7 +85,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:       ID(""),
 					Effect:    Deny,
-					Actions:   NewActionSet(CreateUserAdminAction),
+					Actions:   NewActionSet(Action(CreateUserAdminAction)),
 					Resources: NewResourceSet(NewResource("*")),
 				},
 			},
@@ -117,11 +117,11 @@ var DefaultPolicies = []struct {
 				{
 					SID:    ID(""),
 					Effect: Allow,
-					Actions: NewActionSet(ProfilingAdminAction,
-						TraceAdminAction, ConsoleLogAdminAction,
-						ServerInfoAdminAction, TopLocksAdminAction,
-						HealthInfoAdminAction, BandwidthMonitorAction,
-						PrometheusAdminAction,
+					Actions: NewActionSet(Action(ProfilingAdminAction),
+						Action(TraceAdminAction), Action(ConsoleLogAdminAction),
+						Action(ServerInfoAdminAction), Action(TopLocksAdminAction),
+						Action(HealthInfoAdminAction), Action(BandwidthMonitorAction),
+						Action(PrometheusAdminAction),
 					),
 					Resources: NewResourceSet(NewResource("*")),
 				},
@@ -138,7 +138,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllS3TablesActions),
+					Actions:    NewActionSet(Action(AllS3TablesActions)),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
 				},
@@ -158,36 +158,36 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// User management
-						CreateUserAdminAction,
-						DeleteUserAdminAction,
-						ListUsersAdminAction,
-						EnableUserAdminAction,
-						DisableUserAdminAction,
-						GetUserAdminAction,
+						Action(CreateUserAdminAction),
+						Action(DeleteUserAdminAction),
+						Action(ListUsersAdminAction),
+						Action(EnableUserAdminAction),
+						Action(DisableUserAdminAction),
+						Action(GetUserAdminAction),
 						// Group management
-						AddUserToGroupAdminAction,
-						RemoveUserFromGroupAdminAction,
-						GetGroupAdminAction,
-						ListGroupsAdminAction,
-						EnableGroupAdminAction,
-						DisableGroupAdminAction,
+						Action(AddUserToGroupAdminAction),
+						Action(RemoveUserFromGroupAdminAction),
+						Action(GetGroupAdminAction),
+						Action(ListGroupsAdminAction),
+						Action(EnableGroupAdminAction),
+						Action(DisableGroupAdminAction),
 						// Policy management
-						CreatePolicyAdminAction,
-						DeletePolicyAdminAction,
-						GetPolicyAdminAction,
-						AttachPolicyAdminAction,
-						UpdatePolicyAssociationAction,
-						ListUserPoliciesAdminAction,
+						Action(CreatePolicyAdminAction),
+						Action(DeletePolicyAdminAction),
+						Action(GetPolicyAdminAction),
+						Action(AttachPolicyAdminAction),
+						Action(UpdatePolicyAssociationAction),
+						Action(ListUserPoliciesAdminAction),
 						// Service account management
-						CreateServiceAccountAdminAction,
-						UpdateServiceAccountAdminAction,
-						RemoveServiceAccountAdminAction,
-						ListServiceAccountsAdminAction,
+						Action(CreateServiceAccountAdminAction),
+						Action(UpdateServiceAccountAdminAction),
+						Action(RemoveServiceAccountAdminAction),
+						Action(ListServiceAccountsAdminAction),
 						// Temporary accounts
-						ListTemporaryAccountsAdminAction,
+						Action(ListTemporaryAccountsAdminAction),
 						// IAM import/export
-						ExportIAMAction,
-						ImportIAMAction,
+						Action(ExportIAMAction),
+						Action(ImportIAMAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -209,53 +209,53 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Server lifecycle
-						ServerUpdateAdminAction,
-						ServiceRestartAdminAction,
-						ServiceStopAdminAction,
-						ServiceFreezeAdminAction,
-						ServiceCordonAdminAction,
+						Action(ServerUpdateAdminAction),
+						Action(ServiceRestartAdminAction),
+						Action(ServiceStopAdminAction),
+						Action(ServiceFreezeAdminAction),
+						Action(ServiceCordonAdminAction),
 						// Server info
-						ServerInfoAdminAction,
-						StorageInfoAdminAction,
+						Action(ServerInfoAdminAction),
+						Action(StorageInfoAdminAction),
 						// Configuration
-						ConfigUpdateAdminAction,
+						Action(ConfigUpdateAdminAction),
 						// Healing & recovery
-						HealAdminAction,
-						ForceUnlockAdminAction,
+						Action(HealAdminAction),
+						Action(ForceUnlockAdminAction),
 						// Pool management
-						DecommissionAdminAction,
-						RebalanceAdminAction,
+						Action(DecommissionAdminAction),
+						Action(RebalanceAdminAction),
 						// Bucket admin
-						SetBucketQuotaAdminAction,
-						GetBucketQuotaAdminAction,
-						SetBucketCompressionAdminAction,
-						GetBucketCompressionAdminAction,
+						Action(SetBucketQuotaAdminAction),
+						Action(GetBucketQuotaAdminAction),
+						Action(SetBucketCompressionAdminAction),
+						Action(GetBucketCompressionAdminAction),
 						// Tiers
-						SetTierAction,
-						ListTierAction,
+						Action(SetTierAction),
+						Action(ListTierAction),
 						// Data & license info
-						LicenseInfoAdminAction,
-						DataUsageInfoAdminAction,
+						Action(LicenseInfoAdminAction),
+						Action(DataUsageInfoAdminAction),
 						// Bucket metadata import/export
-						ImportBucketMetadataAction,
-						ExportBucketMetadataAction,
+						Action(ImportBucketMetadataAction),
+						Action(ExportBucketMetadataAction),
 						// Batch jobs
-						StartBatchJobAction,
-						ListBatchJobsAction,
-						DescribeBatchJobAction,
-						CancelBatchJobAction,
-						GenerateBatchJobAction,
+						Action(StartBatchJobAction),
+						Action(ListBatchJobsAction),
+						Action(DescribeBatchJobAction),
+						Action(CancelBatchJobAction),
+						Action(GenerateBatchJobAction),
 						// Inventory
-						InventoryControlAction,
+						Action(InventoryControlAction),
 						// Cluster topology (v4 APIs)
-						ClusterInfoAction,
-						PoolListAction,
-						PoolInfoAction,
-						NodeListAction,
-						NodeInfoAction,
-						SetInfoAction,
-						DriveListAction,
-						DriveInfoAction,
+						Action(ClusterInfoAction),
+						Action(PoolListAction),
+						Action(PoolInfoAction),
+						Action(NodeListAction),
+						Action(NodeInfoAction),
+						Action(SetInfoAction),
+						Action(DriveListAction),
+						Action(DriveInfoAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -277,50 +277,50 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Warehouse read
-						S3TablesGetWarehouseAction,
-						S3TablesGetWarehouseEncryptionAction,
-						S3TablesGetWarehouseMaintenanceConfigurationAction,
-						S3TablesGetWarehousePolicyAction,
-						S3TablesListWarehousesAction,
+						Action(S3TablesGetWarehouseAction),
+						Action(S3TablesGetWarehouseEncryptionAction),
+						Action(S3TablesGetWarehouseMaintenanceConfigurationAction),
+						Action(S3TablesGetWarehousePolicyAction),
+						Action(S3TablesListWarehousesAction),
 						// Namespace read + property updates
-						S3TablesGetNamespaceAction,
-						S3TablesListNamespacesAction,
-						S3TablesUpdateNamespacePropertiesAction,
+						Action(S3TablesGetNamespaceAction),
+						Action(S3TablesListNamespacesAction),
+						Action(S3TablesUpdateNamespacePropertiesAction),
 						// Table read + data write
-						S3TablesGetTableAction,
-						S3TablesListTablesAction,
-						S3TablesGetTableDataAction,
-						S3TablesPutTableDataAction,
-						S3TablesGetTableEncryptionAction,
-						S3TablesGetTableMaintenanceConfigurationAction,
-						S3TablesGetTableMaintenanceJobStatusAction,
-						S3TablesGetTableMetadataLocationAction,
-						S3TablesGetTablePolicyAction,
+						Action(S3TablesGetTableAction),
+						Action(S3TablesListTablesAction),
+						Action(S3TablesGetTableDataAction),
+						Action(S3TablesPutTableDataAction),
+						Action(S3TablesGetTableEncryptionAction),
+						Action(S3TablesGetTableMaintenanceConfigurationAction),
+						Action(S3TablesGetTableMaintenanceJobStatusAction),
+						Action(S3TablesGetTableMetadataLocationAction),
+						Action(S3TablesGetTablePolicyAction),
 						// Table mutations (non-destructive)
-						S3TablesCreateTableAction,
-						S3TablesUpdateTableAction,
-						S3TablesUpdateTableMetadataLocationAction,
-						S3TablesRenameTableAction,
-						S3TablesRegisterTableAction,
+						Action(S3TablesCreateTableAction),
+						Action(S3TablesUpdateTableAction),
+						Action(S3TablesUpdateTableMetadataLocationAction),
+						Action(S3TablesRenameTableAction),
+						Action(S3TablesRegisterTableAction),
 						// Views full CRUD
-						S3TablesGetViewAction,
-						S3TablesListViewsAction,
-						S3TablesCreateViewAction,
-						S3TablesUpdateViewAction,
-						S3TablesRenameViewAction,
-						S3TablesDeleteViewAction,
-						S3TablesRegisterViewAction,
+						Action(S3TablesGetViewAction),
+						Action(S3TablesListViewsAction),
+						Action(S3TablesCreateViewAction),
+						Action(S3TablesUpdateViewAction),
+						Action(S3TablesRenameViewAction),
+						Action(S3TablesDeleteViewAction),
+						Action(S3TablesRegisterViewAction),
 						// Functions (SQL UDFs) full CRUD
-						S3TablesGetFunctionAction,
-						S3TablesListFunctionsAction,
-						S3TablesCreateFunctionAction,
-						S3TablesUpdateFunctionAction,
-						S3TablesRenameFunctionAction,
-						S3TablesDeleteFunctionAction,
-						S3TablesRegisterFunctionAction,
+						Action(S3TablesGetFunctionAction),
+						Action(S3TablesListFunctionsAction),
+						Action(S3TablesCreateFunctionAction),
+						Action(S3TablesUpdateFunctionAction),
+						Action(S3TablesRenameFunctionAction),
+						Action(S3TablesDeleteFunctionAction),
+						Action(S3TablesRegisterFunctionAction),
 						// Catalog config + metrics
-						S3TablesGetConfigAction,
-						S3TablesTableMetricsAction,
+						Action(S3TablesGetConfigAction),
+						Action(S3TablesTableMetricsAction),
 					),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
@@ -341,32 +341,32 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Warehouse read
-						S3TablesGetWarehouseAction,
-						S3TablesGetWarehouseEncryptionAction,
-						S3TablesGetWarehouseMaintenanceConfigurationAction,
-						S3TablesGetWarehousePolicyAction,
-						S3TablesListWarehousesAction,
+						Action(S3TablesGetWarehouseAction),
+						Action(S3TablesGetWarehouseEncryptionAction),
+						Action(S3TablesGetWarehouseMaintenanceConfigurationAction),
+						Action(S3TablesGetWarehousePolicyAction),
+						Action(S3TablesListWarehousesAction),
 						// Namespace read
-						S3TablesGetNamespaceAction,
-						S3TablesListNamespacesAction,
+						Action(S3TablesGetNamespaceAction),
+						Action(S3TablesListNamespacesAction),
 						// Table read
-						S3TablesGetTableAction,
-						S3TablesListTablesAction,
-						S3TablesGetTableDataAction,
-						S3TablesGetTableEncryptionAction,
-						S3TablesGetTableMaintenanceConfigurationAction,
-						S3TablesGetTableMaintenanceJobStatusAction,
-						S3TablesGetTableMetadataLocationAction,
-						S3TablesGetTablePolicyAction,
+						Action(S3TablesGetTableAction),
+						Action(S3TablesListTablesAction),
+						Action(S3TablesGetTableDataAction),
+						Action(S3TablesGetTableEncryptionAction),
+						Action(S3TablesGetTableMaintenanceConfigurationAction),
+						Action(S3TablesGetTableMaintenanceJobStatusAction),
+						Action(S3TablesGetTableMetadataLocationAction),
+						Action(S3TablesGetTablePolicyAction),
 						// View read
-						S3TablesGetViewAction,
-						S3TablesListViewsAction,
+						Action(S3TablesGetViewAction),
+						Action(S3TablesListViewsAction),
 						// Function read
-						S3TablesGetFunctionAction,
-						S3TablesListFunctionsAction,
+						Action(S3TablesGetFunctionAction),
+						Action(S3TablesListFunctionsAction),
 						// Catalog config + metrics
-						S3TablesGetConfigAction,
-						S3TablesTableMetricsAction,
+						Action(S3TablesGetConfigAction),
+						Action(S3TablesTableMetricsAction),
 					),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
@@ -387,20 +387,20 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// Site replication management
-						SiteReplicationAddAction,
-						SiteReplicationDisableAction,
-						SiteReplicationRemoveAction,
-						SiteReplicationResyncAction,
-						SiteReplicationInfoAction,
-						SiteReplicationOperationAction,
+						Action(SiteReplicationAddAction),
+						Action(SiteReplicationDisableAction),
+						Action(SiteReplicationRemoveAction),
+						Action(SiteReplicationResyncAction),
+						Action(SiteReplicationInfoAction),
+						Action(SiteReplicationOperationAction),
 						// Tables replication management
-						TablesReplicationAddAction,
-						TablesReplicationRemoveAction,
-						TablesReplicationInfoAction,
-						TablesReplicationStartFailoverAction,
-						TablesReplicationCatalogAdminAction,
+						Action(TablesReplicationAddAction),
+						Action(TablesReplicationRemoveAction),
+						Action(TablesReplicationInfoAction),
+						Action(TablesReplicationStartFailoverAction),
+						Action(TablesReplicationCatalogAdminAction),
 						// Replication diagnostics
-						ReplicationDiff,
+						Action(ReplicationDiff),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -436,39 +436,39 @@ var DefaultPolicies = []struct {
 					Effect: Allow,
 					Actions: NewActionSet(
 						// IAM read
-						ListUsersAdminAction,
-						GetUserAdminAction,
-						ListGroupsAdminAction,
-						GetGroupAdminAction,
-						GetPolicyAdminAction,
-						ListUserPoliciesAdminAction,
-						ListServiceAccountsAdminAction,
-						ListTemporaryAccountsAdminAction,
-						ExportIAMAction,
+						Action(ListUsersAdminAction),
+						Action(GetUserAdminAction),
+						Action(ListGroupsAdminAction),
+						Action(GetGroupAdminAction),
+						Action(GetPolicyAdminAction),
+						Action(ListUserPoliciesAdminAction),
+						Action(ListServiceAccountsAdminAction),
+						Action(ListTemporaryAccountsAdminAction),
+						Action(ExportIAMAction),
 						// Replication info (read-only)
-						SiteReplicationInfoAction,
-						TablesReplicationInfoAction,
+						Action(SiteReplicationInfoAction),
+						Action(TablesReplicationInfoAction),
 						// Server & cluster topology (read-only)
-						ServerInfoAdminAction,
-						StorageInfoAdminAction,
-						DataUsageInfoAdminAction,
-						LicenseInfoAdminAction,
-						ClusterInfoAction,
-						PoolListAction,
-						PoolInfoAction,
-						NodeListAction,
-						NodeInfoAction,
-						SetInfoAction,
-						DriveListAction,
-						DriveInfoAction,
+						Action(ServerInfoAdminAction),
+						Action(StorageInfoAdminAction),
+						Action(DataUsageInfoAdminAction),
+						Action(LicenseInfoAdminAction),
+						Action(ClusterInfoAction),
+						Action(PoolListAction),
+						Action(PoolInfoAction),
+						Action(NodeListAction),
+						Action(NodeInfoAction),
+						Action(SetInfoAction),
+						Action(DriveListAction),
+						Action(DriveInfoAction),
 						// Diagnostics (read-only)
-						ProfilingAdminAction,
-						TraceAdminAction,
-						ConsoleLogAdminAction,
-						TopLocksAdminAction,
-						HealthInfoAdminAction,
-						BandwidthMonitorAction,
-						PrometheusAdminAction,
+						Action(ProfilingAdminAction),
+						Action(TraceAdminAction),
+						Action(ConsoleLogAdminAction),
+						Action(TopLocksAdminAction),
+						Action(HealthInfoAdminAction),
+						Action(BandwidthMonitorAction),
+						Action(PrometheusAdminAction),
 					),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
@@ -503,14 +503,14 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllAdminActions),
+					Actions:    NewActionSet(Action(AllAdminActions)),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
 				},
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllKMSActions),
+					Actions:    NewActionSet(Action(AllKMSActions)),
 					Resources:  NewResourceSet(),
 					Conditions: condition.NewFunctions(),
 				},
@@ -524,7 +524,7 @@ var DefaultPolicies = []struct {
 				{
 					SID:        ID(""),
 					Effect:     Allow,
-					Actions:    NewActionSet(AllS3TablesActions),
+					Actions:    NewActionSet(Action(AllS3TablesActions)),
 					Resources:  NewResourceSet(NewS3TablesResource("*")),
 					Conditions: condition.NewFunctions(),
 				},
diff --git a/policy/constants_test.go b/policy/constants_test.go
index 3ade9405..7458d18c 100644
--- a/policy/constants_test.go
+++ b/policy/constants_test.go
@@ -38,7 +38,7 @@ func TestDefaultPolicyReadOnly(t *testing.T) {
 	}
 
 	allowed := NewActionSet(GetBucketLocationAction, GetObjectAction)
-	denied := NewActionSet(CreateUserAdminAction)
+	denied := NewActionSet(Action(CreateUserAdminAction))
 
 	var sawAllow, sawDeny bool
 	for _, s := range p.Statements {
@@ -70,7 +70,7 @@ func TestDefaultPolicyConsoleReadOnly(t *testing.T) {
 	}
 
 	allowed := NewActionSet(GetBucketLocationAction, GetObjectAction, ListBucketAction)
-	denied := NewActionSet(CreateUserAdminAction)
+	denied := NewActionSet(Action(CreateUserAdminAction))
 
 	var sawAllow, sawDeny bool
 	for _, s := range p.Statements {
diff --git a/policy/kms-action.go b/policy/kms-action.go
index a614b761..ae1363a7 100644
--- a/policy/kms-action.go
+++ b/policy/kms-action.go
@@ -22,49 +22,49 @@ type KMSAction string
 
 const (
 	// KMSCreateKeyAction - allow creating a new KMS master key
-	KMSCreateKeyAction = "kms:CreateKey"
+	KMSCreateKeyAction KMSAction = "kms:CreateKey"
 	// KMSDeleteKeyAction - allow deleting a KMS master key
-	KMSDeleteKeyAction = "kms:DeleteKey"
+	KMSDeleteKeyAction KMSAction = "kms:DeleteKey"
 	// KMSListKeysAction - allow getting list of KMS keys
-	KMSListKeysAction = "kms:ListKeys"
+	KMSListKeysAction KMSAction = "kms:ListKeys"
 	// KMSImportKeyAction - allow importing KMS key
-	KMSImportKeyAction = "kms:ImportKey"
+	KMSImportKeyAction KMSAction = "kms:ImportKey"
 	// KMSDescribePolicyAction - allow getting KMS policy
-	KMSDescribePolicyAction = "kms:DescribePolicy"
+	KMSDescribePolicyAction KMSAction = "kms:DescribePolicy"
 	// KMSAssignPolicyAction - allow assigning an identity to a KMS policy
-	KMSAssignPolicyAction = "kms:AssignPolicy"
+	KMSAssignPolicyAction KMSAction = "kms:AssignPolicy"
 	// KMSDeletePolicyAction - allow deleting a policy
-	KMSDeletePolicyAction = "kms:DeletePolicy"
+	KMSDeletePolicyAction KMSAction = "kms:DeletePolicy"
 	// KMSSetPolicyAction - allow creating or updating a policy
-	KMSSetPolicyAction = "kms:SetPolicy"
+	KMSSetPolicyAction KMSAction = "kms:SetPolicy"
 	// KMSGetPolicyAction - allow getting a policy
-	KMSGetPolicyAction = "kms:GetPolicy"
+	KMSGetPolicyAction KMSAction = "kms:GetPolicy"
 	// KMSListPoliciesAction - allow getting list of KMS policies
-	KMSListPoliciesAction = "kms:ListPolicies"
+	KMSListPoliciesAction KMSAction = "kms:ListPolicies"
 	// KMSDescribeIdentityAction - allow getting KMS identity
-	KMSDescribeIdentityAction = "kms:DescribeIdentity"
+	KMSDescribeIdentityAction KMSAction = "kms:DescribeIdentity"
 	// KMSDescribeSelfIdentityAction - allow getting self KMS identity
-	KMSDescribeSelfIdentityAction = "kms:DescribeSelfIdentity"
+	KMSDescribeSelfIdentityAction KMSAction = "kms:DescribeSelfIdentity"
 	// KMSDeleteIdentityAction - allow deleting a policy
-	KMSDeleteIdentityAction = "kms:DeleteIdentity"
+	KMSDeleteIdentityAction KMSAction = "kms:DeleteIdentity"
 	// KMSListIdentitiesAction - allow getting list of KMS identities
-	KMSListIdentitiesAction = "kms:ListIdentities"
+	KMSListIdentitiesAction KMSAction = "kms:ListIdentities"
 	// KMSKeyStatusAction - allow getting KMS key status
-	KMSKeyStatusAction = "kms:KeyStatus"
+	KMSKeyStatusAction KMSAction = "kms:KeyStatus"
 	// KMSStatusAction - allow getting KMS status
-	KMSStatusAction = "kms:Status"
+	KMSStatusAction KMSAction = "kms:Status"
 	// KMSAPIAction - allow getting a list of supported API endpoints
-	KMSAPIAction = "kms:API"
+	KMSAPIAction KMSAction = "kms:API"
 	// KMSMetricsAction - allow getting server metrics in the Prometheus exposition format
-	KMSMetricsAction = "kms:Metrics"
+	KMSMetricsAction KMSAction = "kms:Metrics"
 	// KMSVersionAction - allow getting version information
-	KMSVersionAction = "kms:Version"
+	KMSVersionAction KMSAction = "kms:Version"
 	// KMSAuditLogAction - subscribes to the audit log
-	KMSAuditLogAction = "kms:AuditLog"
+	KMSAuditLogAction KMSAction = "kms:AuditLog"
 	// KMSErrorLogAction - subscribes to the error log
-	KMSErrorLogAction = "kms:ErrorLog"
+	KMSErrorLogAction KMSAction = "kms:ErrorLog"
 	// AllKMSActions - provides all admin permissions
-	AllKMSActions = "kms:*"
+	AllKMSActions KMSAction = "kms:*"
 )
 
 // List of all supported admin actions.
diff --git a/policy/memory-action.go b/policy/memory-action.go
index 08c13ab7..34c18dbe 100644
--- a/policy/memory-action.go
+++ b/policy/memory-action.go
@@ -30,31 +30,31 @@ const (
 	MemoryCreateCortexAction MemoryAction = "memory:CreateCortex"
 
 	// MemoryDeleteCortexAction - delete a Memory cortex.
-	MemoryDeleteCortexAction = "memory:DeleteCortex"
+	MemoryDeleteCortexAction MemoryAction = "memory:DeleteCortex"
 
 	// MemoryGetCortexAction - read a Memory cortex's metadata.
-	MemoryGetCortexAction = "memory:GetCortex"
+	MemoryGetCortexAction MemoryAction = "memory:GetCortex"
 
 	// MemoryListCortexesAction - list Memory cortexes.
-	MemoryListCortexesAction = "memory:ListCortexes"
+	MemoryListCortexesAction MemoryAction = "memory:ListCortexes"
 
 	// MemoryPutSecretAction - write a secret in a cortex.
-	MemoryPutSecretAction = "memory:PutSecret"
+	MemoryPutSecretAction MemoryAction = "memory:PutSecret"
 
 	// MemoryGetSecretAction - read a secret's decrypted value from a cortex.
-	MemoryGetSecretAction = "memory:GetSecret"
+	MemoryGetSecretAction MemoryAction = "memory:GetSecret"
 
 	// MemoryDeleteSecretAction - delete a secret from a cortex.
-	MemoryDeleteSecretAction = "memory:DeleteSecret"
+	MemoryDeleteSecretAction MemoryAction = "memory:DeleteSecret"
 
 	// MemoryListSecretsAction - list the secrets in a cortex.
-	MemoryListSecretsAction = "memory:ListSecrets"
+	MemoryListSecretsAction MemoryAction = "memory:ListSecrets"
 
 	// MemorySearchAction - search (corpus-grep) the objects in a cortex.
-	MemorySearchAction = "memory:Search"
+	MemorySearchAction MemoryAction = "memory:Search"
 
 	// AllMemoryActions - all AIStor Memory API actions.
-	AllMemoryActions = "memory:*"
+	AllMemoryActions MemoryAction = "memory:*"
 )
 
 // SupportedMemoryActions - list of all supported AIStor Memory API actions.
diff --git a/policy/policy_test.go b/policy/policy_test.go
index a3ef64cc..bcaaf36a 100644
--- a/policy/policy_test.go
+++ b/policy/policy_test.go
@@ -103,11 +103,11 @@ func TestAdminPolicyResource(t *testing.T) {
 	}
 
 	allowedActions := p.IsAllowedActions("", "", map[string][]string{})
-	if !allowedActions.Match(ListServiceAccountsAdminAction) {
+	if !allowedActions.Match(Action(ListServiceAccountsAdminAction)) {
 		t.Fatal("expected success for ListServiceAccounts, but failed to match")
 	}
 
-	if !allowedActions.Match(GetBucketQuotaAdminAction) {
+	if !allowedActions.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected success for GetBucketQuota, but failed to match")
 	}
 }
@@ -1298,7 +1298,7 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Allow,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1354,14 +1354,14 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
 			NewStatement(
 				"",
 				Allow,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1411,7 +1411,7 @@ func TestPolicyUnmarshalJSONAndValidate(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1554,7 +1554,7 @@ func TestMergePolicies(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1575,7 +1575,7 @@ func TestMergePolicies(t *testing.T) {
 			NewStatement(
 				"",
 				Deny,
-				NewActionSet(AllAdminActions),
+				NewActionSet(Action(AllAdminActions)),
 				ResourceSet{},
 				condition.NewFunctions(),
 			),
@@ -1636,7 +1636,7 @@ func TestMergePolicies(t *testing.T) {
 					NewStatement(
 						"",
 						Deny,
-						NewActionSet(AllAdminActions),
+						NewActionSet(Action(AllAdminActions)),
 						ResourceSet{},
 						condition.NewFunctions(),
 					),
@@ -1665,7 +1665,7 @@ func TestMergePolicies(t *testing.T) {
 					NewStatement(
 						"",
 						Deny,
-						NewActionSet(AllAdminActions),
+						NewActionSet(Action(AllAdminActions)),
 						ResourceSet{},
 						condition.NewFunctions(),
 					),
@@ -2101,7 +2101,7 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
     }
   ]
 }`,
-			expectedActions:   []Action{S3TablesPutTableBucketMaintenanceConfigurationAction},
+			expectedActions:   []Action{Action(S3TablesPutTableBucketMaintenanceConfigurationAction)},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/*"},
 		},
 		{
@@ -2124,7 +2124,7 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
     }
   ]
 }`,
-			expectedActions:   []Action{S3TablesGetTableDataAction, S3TablesGetTableMetadataLocationAction},
+			expectedActions:   []Action{Action(S3TablesGetTableDataAction), Action(S3TablesGetTableMetadataLocationAction)},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/amzn-s3-demo-table-bucket/table/*"},
 			expectedCondKeys:  []condition.KeyName{condition.S3TablesNamespace},
 		},
@@ -2147,10 +2147,10 @@ func TestPolicyParseS3TablesExamples(t *testing.T) {
   ]
 }`,
 			expectedActions: []Action{
-				S3TablesDeleteTableAction,
-				S3TablesUpdateTableMetadataLocationAction,
-				S3TablesPutTableDataAction,
-				S3TablesGetTableMetadataLocationAction,
+				Action(S3TablesDeleteTableAction),
+				Action(S3TablesUpdateTableMetadataLocationAction),
+				Action(S3TablesPutTableDataAction),
+				Action(S3TablesGetTableMetadataLocationAction),
 			},
 			expectedResources: []string{"arn:aws:s3tables:::bucket/amzn-s3-demo-bucket/table/tableUUID"},
 		},
@@ -2268,7 +2268,7 @@ func TestS3TablesActionsWithImplicitMatching(t *testing.T) {
 			name:       "GetTableData direct match",
 			policyJSON: policy1JSON,
 			args: Args{
-				Action:     S3TablesGetTableDataAction,
+				Action:     Action(S3TablesGetTableDataAction),
 				BucketName: "bucket/my-warehouse/table/table-uuid-123",
 			},
 			expectedResult: true,
@@ -2333,7 +2333,7 @@ func TestS3TablesActionsWithImplicitMatching(t *testing.T) {
 			name:       "PutTableData direct match",
 			policyJSON: policy2JSON,
 			args: Args{
-				Action:     S3TablesPutTableDataAction,
+				Action:     Action(S3TablesPutTableDataAction),
 				BucketName: "bucket/test-warehouse/table/uuid-456",
 			},
 			expectedResult: true,
@@ -2736,13 +2736,13 @@ func TestAdminActionResourceScoping(t *testing.T) {
 
 	// Matching bucket must be allowed.
 	allowed := p.IsAllowedActions("mybucket", "", map[string][]string{})
-	if !allowed.Match(GetBucketQuotaAdminAction) {
+	if !allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota allowed for mybucket")
 	}
 
 	// Different bucket must be denied.
 	allowed = p.IsAllowedActions("otherbucket", "", map[string][]string{})
-	if allowed.Match(GetBucketQuotaAdminAction) {
+	if allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota denied for otherbucket")
 	}
 
@@ -2761,7 +2761,7 @@ func TestAdminActionResourceScoping(t *testing.T) {
 		t.Fatal(err)
 	}
 	allowed = p.IsAllowedActions("", "", map[string][]string{})
-	if !allowed.Match(ServerInfoAdminAction) {
+	if !allowed.Match(Action(ServerInfoAdminAction)) {
 		t.Fatal("expected ServerInfo allowed without resource")
 	}
 
@@ -2780,10 +2780,10 @@ func TestAdminActionResourceScoping(t *testing.T) {
 		t.Fatal(err)
 	}
 	allowed = p.IsAllowedActions("", "", map[string][]string{})
-	if !allowed.Match(ServerInfoAdminAction) {
+	if !allowed.Match(Action(ServerInfoAdminAction)) {
 		t.Fatal("expected ServerInfo allowed with admin:* and no resource")
 	}
-	if !allowed.Match(GetBucketQuotaAdminAction) {
+	if !allowed.Match(Action(GetBucketQuotaAdminAction)) {
 		t.Fatal("expected GetBucketQuota allowed with admin:* and no resource constraint")
 	}
 }
diff --git a/policy/statement_test.go b/policy/statement_test.go
index 9e16d2aa..d4aa6057 100644
--- a/policy/statement_test.go
+++ b/policy/statement_test.go
@@ -329,13 +329,13 @@ func TestStatementIsValid(t *testing.T) {
 		), false},
 		{NewStatement("",
 			Allow,
-			NewActionSet(CreateUserAdminAction, DeleteUserAdminAction),
+			NewActionSet(Action(CreateUserAdminAction), Action(DeleteUserAdminAction)),
 			nil,
 			condition.NewFunctions(func2, func3),
 		), true},
 		{NewStatement("",
 			Allow,
-			NewActionSet(CreateUserAdminAction, DeleteUserAdminAction),
+			NewActionSet(Action(CreateUserAdminAction), Action(DeleteUserAdminAction)),
 			nil,
 			condition.NewFunctions(),
 		), false},
diff --git a/policy/sts-action.go b/policy/sts-action.go
index 37a59f53..62fc99e7 100644
--- a/policy/sts-action.go
+++ b/policy/sts-action.go
@@ -26,25 +26,25 @@ type STSAction string
 
 const (
 	// AssumeRoleAction - use to deny or allow sts:AssumeRole action under specific conditions.
-	AssumeRoleAction = "sts:AssumeRole"
+	AssumeRoleAction STSAction = "sts:AssumeRole"
 
 	// AssumeRoleLDAPIdentityAction - use to deny or allow sts:AssumeRoleLDAPIdentity action under specific conditions.
-	AssumeRoleLDAPIdentityAction = "sts:AssumeRoleLDAPIdentity"
+	AssumeRoleLDAPIdentityAction STSAction = "sts:AssumeRoleLDAPIdentity"
 
 	// AssumeRoleWithCustomTokenAction - use to deny or allow sts:AssumeRoleWithCustomToken action under specific conditions.
-	AssumeRoleWithCustomTokenAction = "sts:AssumeRoleWithCustomToken"
+	AssumeRoleWithCustomTokenAction STSAction = "sts:AssumeRoleWithCustomToken"
 
 	// AssumeRoleWithWebIdentityAction - use to deny or allow sts:AssumeRoleWithWebIdentity action under specific conditions.
-	AssumeRoleWithWebIdentityAction = "sts:AssumeRoleWithWebIdentity"
+	AssumeRoleWithWebIdentityAction STSAction = "sts:AssumeRoleWithWebIdentity"
 
 	// AssumeRoleWithClientGrantsAction - use to deny or allow sts:AssumeRoleWithClientGrants action under specific conditions.
-	AssumeRoleWithClientGrantsAction = "sts:AssumeRoleWithClientGrants"
+	AssumeRoleWithClientGrantsAction STSAction = "sts:AssumeRoleWithClientGrants"
 
 	// AssumeRoleWithClientCertificateAction - use to deny or allow sts:AssumeRoleWithClientCertificate action under specific conditions.
-	AssumeRoleWithClientCertificateAction = "sts:AssumeRoleWithClientCertificate"
+	AssumeRoleWithClientCertificateAction STSAction = "sts:AssumeRoleWithClientCertificate"
 
 	// AllSTSActions - select all STS actions
-	AllSTSActions = "sts:*"
+	AllSTSActions STSAction = "sts:*"
 )
 
 // List of all supported sts actions.
@@ -71,13 +71,13 @@ func createSTSActionConditionKeyMap() map[Action]condition.KeySet {
 	}
 
 	return ActionConditionKeyMap{
-		AllSTSActions:                         condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleAction:                      condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleLDAPIdentityAction:          condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithWebIdentityAction:       condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithCustomTokenAction:       condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithClientGrantsAction:      condition.NewKeySet(allSupportedSTSKeys...),
-		AssumeRoleWithClientCertificateAction: condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AllSTSActions):                         condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleAction):                      condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleLDAPIdentityAction):          condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithWebIdentityAction):       condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithCustomTokenAction):       condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithClientGrantsAction):      condition.NewKeySet(allSupportedSTSKeys...),
+		Action(AssumeRoleWithClientCertificateAction): condition.NewKeySet(allSupportedSTSKeys...),
 	}
 }
 
diff --git a/policy/table-action.go b/policy/table-action.go
index 0c61f72b..1855cec2 100644
--- a/policy/table-action.go
+++ b/policy/table-action.go
@@ -26,225 +26,225 @@ type TableAction string
 
 const (
 	// S3TablesCreateNamespaceAction maps to the AWS `CreateNamespace` S3 Tables action.
-	S3TablesCreateNamespaceAction = "s3tables:CreateNamespace"
+	S3TablesCreateNamespaceAction TableAction = "s3tables:CreateNamespace"
 
 	// S3TablesCreateTableAction maps to the AWS `CreateTable` S3 Tables action.
-	S3TablesCreateTableAction = "s3tables:CreateTable"
+	S3TablesCreateTableAction TableAction = "s3tables:CreateTable"
 
 	// S3TablesDeleteNamespaceAction maps to the AWS `DeleteNamespace` S3 Tables action.
-	S3TablesDeleteNamespaceAction = "s3tables:DeleteNamespace"
+	S3TablesDeleteNamespaceAction TableAction = "s3tables:DeleteNamespace"
 
 	// S3TablesDeleteTableAction maps to the AWS `DeleteTable` S3 Tables action.
-	S3TablesDeleteTableAction = "s3tables:DeleteTable"
+	S3TablesDeleteTableAction TableAction = "s3tables:DeleteTable"
 
 	// S3TablesDeleteTablePolicyAction maps to the AWS `DeleteTablePolicy` S3 Tables action.
-	S3TablesDeleteTablePolicyAction = "s3tables:DeleteTablePolicy"
+	S3TablesDeleteTablePolicyAction TableAction = "s3tables:DeleteTablePolicy"
 
 	// S3TablesGetNamespaceAction maps to the AWS `GetNamespace` S3 Tables action.
-	S3TablesGetNamespaceAction = "s3tables:GetNamespace"
+	S3TablesGetNamespaceAction TableAction = "s3tables:GetNamespace"
 
 	// S3TablesGetTableAction maps to the AWS `GetTable` S3 Tables action.
-	S3TablesGetTableAction = "s3tables:GetTable"
+	S3TablesGetTableAction TableAction = "s3tables:GetTable"
 
 	// S3TablesGetTableDataAction maps to the AWS `GetTableData` S3 Tables action.
-	S3TablesGetTableDataAction = "s3tables:GetTableData"
+	S3TablesGetTableDataAction TableAction = "s3tables:GetTableData"
 
 	// S3TablesGetTableEncryptionAction maps to the AWS `GetTableEncryption` S3 Tables action.
-	S3TablesGetTableEncryptionAction = "s3tables:GetTableEncryption"
+	S3TablesGetTableEncryptionAction TableAction = "s3tables:GetTableEncryption"
 
 	// S3TablesGetTableMaintenanceConfigurationAction maps to the AWS `GetTableMaintenanceConfiguration` S3 Tables action.
-	S3TablesGetTableMaintenanceConfigurationAction = "s3tables:GetTableMaintenanceConfiguration"
+	S3TablesGetTableMaintenanceConfigurationAction TableAction = "s3tables:GetTableMaintenanceConfiguration"
 
 	// S3TablesGetTableMaintenanceJobStatusAction maps to the AWS `GetTableMaintenanceJobStatus` S3 Tables action.
-	S3TablesGetTableMaintenanceJobStatusAction = "s3tables:GetTableMaintenanceJobStatus"
+	S3TablesGetTableMaintenanceJobStatusAction TableAction = "s3tables:GetTableMaintenanceJobStatus"
 
 	// S3TablesGetTableMetadataLocationAction maps to the AWS `GetTableMetadataLocation` S3 Tables action.
-	S3TablesGetTableMetadataLocationAction = "s3tables:GetTableMetadataLocation"
+	S3TablesGetTableMetadataLocationAction TableAction = "s3tables:GetTableMetadataLocation"
 
 	// S3TablesGetTablePolicyAction maps to the AWS `GetTablePolicy` S3 Tables action.
-	S3TablesGetTablePolicyAction = "s3tables:GetTablePolicy"
+	S3TablesGetTablePolicyAction TableAction = "s3tables:GetTablePolicy"
 
 	// S3TablesListNamespacesAction maps to the AWS `ListNamespaces` S3 Tables action.
-	S3TablesListNamespacesAction = "s3tables:ListNamespaces"
+	S3TablesListNamespacesAction TableAction = "s3tables:ListNamespaces"
 
 	// S3TablesListTablesAction maps to the AWS `ListTables` S3 Tables action.
-	S3TablesListTablesAction = "s3tables:ListTables"
+	S3TablesListTablesAction TableAction = "s3tables:ListTables"
 
 	// S3TablesPutTableDataAction maps to the AWS `PutTableData` S3 Tables action.
-	S3TablesPutTableDataAction = "s3tables:PutTableData"
+	S3TablesPutTableDataAction TableAction = "s3tables:PutTableData"
 
 	// S3TablesPutTableEncryptionAction maps to the AWS `PutTableEncryption` S3 Tables action.
-	S3TablesPutTableEncryptionAction = "s3tables:PutTableEncryption"
+	S3TablesPutTableEncryptionAction TableAction = "s3tables:PutTableEncryption"
 
 	// S3TablesPutTableMaintenanceConfigurationAction maps to the AWS `PutTableMaintenanceConfiguration` S3 Tables action.
-	S3TablesPutTableMaintenanceConfigurationAction = "s3tables:PutTableMaintenanceConfiguration"
+	S3TablesPutTableMaintenanceConfigurationAction TableAction = "s3tables:PutTableMaintenanceConfiguration"
 
 	// S3TablesPutTablePolicyAction maps to the AWS `PutTablePolicy` S3 Tables action.
-	S3TablesPutTablePolicyAction = "s3tables:PutTablePolicy"
+	S3TablesPutTablePolicyAction TableAction = "s3tables:PutTablePolicy"
 
 	// S3TablesRegisterTableAction maps to the AWS `RegisterTable` S3 Tables action.
-	S3TablesRegisterTableAction = "s3tables:RegisterTable"
+	S3TablesRegisterTableAction TableAction = "s3tables:RegisterTable"
 
 	// S3TablesRenameTableAction maps to the AWS `RenameTable` S3 Tables action.
-	S3TablesRenameTableAction = "s3tables:RenameTable"
+	S3TablesRenameTableAction TableAction = "s3tables:RenameTable"
 
 	// S3TablesUpdateTableMetadataLocationAction maps to the AWS `UpdateTableMetadataLocation` S3 Tables action.
-	S3TablesUpdateTableMetadataLocationAction = "s3tables:UpdateTableMetadataLocation"
+	S3TablesUpdateTableMetadataLocationAction TableAction = "s3tables:UpdateTableMetadataLocation"
 
 	// S3TablesCreateWarehouseAction is a MinIO extension for Iceberg warehouse provisioning.
-	S3TablesCreateWarehouseAction = "s3tables:CreateWarehouse"
+	S3TablesCreateWarehouseAction TableAction = "s3tables:CreateWarehouse"
 
 	// S3TablesCreateTableBucketAction maps to the AWS `CreateTableBucket` S3 Tables action.
 	// Prefer using S3TablesCreateWarehouseAction instead.
-	S3TablesCreateTableBucketAction = "s3tables:CreateTableBucket"
+	S3TablesCreateTableBucketAction TableAction = "s3tables:CreateTableBucket"
 
 	// S3TablesDeleteWarehouseAction is a MinIO extension for deleting Iceberg warehouses.
-	S3TablesDeleteWarehouseAction = "s3tables:DeleteWarehouse"
+	S3TablesDeleteWarehouseAction TableAction = "s3tables:DeleteWarehouse"
 
 	// S3TablesDeleteTableBucketAction maps to the AWS `DeleteTableBucket` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehouseAction instead.
-	S3TablesDeleteTableBucketAction = "s3tables:DeleteTableBucket"
+	S3TablesDeleteTableBucketAction TableAction = "s3tables:DeleteTableBucket"
 
 	// S3TablesDeleteWarehouseEncryptionAction is a MinIO extension for deleting warehouse encryption configuration.
-	S3TablesDeleteWarehouseEncryptionAction = "s3tables:DeleteWarehouseEncryption"
+	S3TablesDeleteWarehouseEncryptionAction TableAction = "s3tables:DeleteWarehouseEncryption"
 
 	// S3TablesDeleteTableBucketEncryptionAction maps to the AWS `DeleteTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehouseEncryptionAction instead.
-	S3TablesDeleteTableBucketEncryptionAction = "s3tables:DeleteTableBucketEncryption"
+	S3TablesDeleteTableBucketEncryptionAction TableAction = "s3tables:DeleteTableBucketEncryption"
 
 	// S3TablesDeleteWarehousePolicyAction is a MinIO extension for deleting warehouse policies.
-	S3TablesDeleteWarehousePolicyAction = "s3tables:DeleteWarehousePolicy"
+	S3TablesDeleteWarehousePolicyAction TableAction = "s3tables:DeleteWarehousePolicy"
 
 	// S3TablesDeleteTableBucketPolicyAction maps to the AWS `DeleteTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesDeleteWarehousePolicyAction instead.
-	S3TablesDeleteTableBucketPolicyAction = "s3tables:DeleteTableBucketPolicy"
+	S3TablesDeleteTableBucketPolicyAction TableAction = "s3tables:DeleteTableBucketPolicy"
 
 	// S3TablesGetWarehouseAction is a MinIO extension for retrieving warehouse details.
-	S3TablesGetWarehouseAction = "s3tables:GetWarehouse"
+	S3TablesGetWarehouseAction TableAction = "s3tables:GetWarehouse"
 
 	// S3TablesGetTableBucketAction maps to the AWS `GetTableBucket` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseAction instead.
-	S3TablesGetTableBucketAction = "s3tables:GetTableBucket"
+	S3TablesGetTableBucketAction TableAction = "s3tables:GetTableBucket"
 
 	// S3TablesGetWarehouseEncryptionAction is a MinIO extension for retrieving warehouse encryption configuration.
-	S3TablesGetWarehouseEncryptionAction = "s3tables:GetWarehouseEncryption"
+	S3TablesGetWarehouseEncryptionAction TableAction = "s3tables:GetWarehouseEncryption"
 
 	// S3TablesGetTableBucketEncryptionAction maps to the AWS `GetTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseEncryptionAction instead.
-	S3TablesGetTableBucketEncryptionAction = "s3tables:GetTableBucketEncryption"
+	S3TablesGetTableBucketEncryptionAction TableAction = "s3tables:GetTableBucketEncryption"
 
 	// S3TablesGetWarehouseMaintenanceConfigurationAction is a MinIO extension for retrieving warehouse maintenance configuration.
-	S3TablesGetWarehouseMaintenanceConfigurationAction = "s3tables:GetWarehouseMaintenanceConfiguration"
+	S3TablesGetWarehouseMaintenanceConfigurationAction TableAction = "s3tables:GetWarehouseMaintenanceConfiguration"
 
 	// S3TablesGetTableBucketMaintenanceConfigurationAction maps to the AWS `GetTableBucketMaintenanceConfiguration` S3 Tables action.
 	// Prefer using S3TablesGetWarehouseMaintenanceConfigurationAction instead.
-	S3TablesGetTableBucketMaintenanceConfigurationAction = "s3tables:GetTableBucketMaintenanceConfiguration"
+	S3TablesGetTableBucketMaintenanceConfigurationAction TableAction = "s3tables:GetTableBucketMaintenanceConfiguration"
 
 	// S3TablesGetWarehousePolicyAction is a MinIO extension for retrieving warehouse policies.
-	S3TablesGetWarehousePolicyAction = "s3tables:GetWarehousePolicy"
+	S3TablesGetWarehousePolicyAction TableAction = "s3tables:GetWarehousePolicy"
 
 	// S3TablesGetTableBucketPolicyAction maps to the AWS `GetTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesGetWarehousePolicyAction instead.
-	S3TablesGetTableBucketPolicyAction = "s3tables:GetTableBucketPolicy"
+	S3TablesGetTableBucketPolicyAction TableAction = "s3tables:GetTableBucketPolicy"
 
 	// S3TablesListWarehousesAction is a MinIO extension for listing Iceberg warehouses.
-	S3TablesListWarehousesAction = "s3tables:ListWarehouses"
+	S3TablesListWarehousesAction TableAction = "s3tables:ListWarehouses"
 
 	// S3TablesListTableBucketsAction maps to the AWS `ListTableBuckets` S3 Tables action.
 	// Prefer using S3TablesListWarehousesAction instead.
-	S3TablesListTableBucketsAction = "s3tables:ListTableBuckets"
+	S3TablesListTableBucketsAction TableAction = "s3tables:ListTableBuckets"
 
 	// S3TablesPutWarehouseEncryptionAction is a MinIO extension for setting warehouse encryption configuration.
-	S3TablesPutWarehouseEncryptionAction = "s3tables:PutWarehouseEncryption"
+	S3TablesPutWarehouseEncryptionAction TableAction = "s3tables:PutWarehouseEncryption"
 
 	// S3TablesPutTableBucketEncryptionAction maps to the AWS `PutTableBucketEncryption` S3 Tables action.
 	// Prefer using S3TablesPutWarehouseEncryptionAction instead.
-	S3TablesPutTableBucketEncryptionAction = "s3tables:PutTableBucketEncryption"
+	S3TablesPutTableBucketEncryptionAction TableAction = "s3tables:PutTableBucketEncryption"
 
 	// S3TablesPutWarehouseMaintenanceConfigurationAction is a MinIO extension for setting warehouse maintenance configuration.
-	S3TablesPutWarehouseMaintenanceConfigurationAction = "s3tables:PutWarehouseMaintenanceConfiguration"
+	S3TablesPutWarehouseMaintenanceConfigurationAction TableAction = "s3tables:PutWarehouseMaintenanceConfiguration"
 
 	// S3TablesPutTableBucketMaintenanceConfigurationAction maps to the AWS `PutTableBucketMaintenanceConfiguration` S3 Tables action.
 	// Prefer using S3TablesPutWarehouseMaintenanceConfigurationAction instead.
-	S3TablesPutTableBucketMaintenanceConfigurationAction = "s3tables:PutTableBucketMaintenanceConfiguration"
+	S3TablesPutTableBucketMaintenanceConfigurationAction TableAction = "s3tables:PutTableBucketMaintenanceConfiguration"
 
 	// S3TablesPutWarehousePolicyAction is a MinIO extension for setting warehouse policies.
-	S3TablesPutWarehousePolicyAction = "s3tables:PutWarehousePolicy"
+	S3TablesPutWarehousePolicyAction TableAction = "s3tables:PutWarehousePolicy"
 
 	// S3TablesPutTableBucketPolicyAction maps to the AWS `PutTableBucketPolicy` S3 Tables action.
 	// Prefer using S3TablesPutWarehousePolicyAction instead.
-	S3TablesPutTableBucketPolicyAction = "s3tables:PutTableBucketPolicy"
+	S3TablesPutTableBucketPolicyAction TableAction = "s3tables:PutTableBucketPolicy"
 
 	// S3TablesGetConfigAction is a MinIO extension for retrieving catalog configuration.
-	S3TablesGetConfigAction = "s3tables:GetConfig"
+	S3TablesGetConfigAction TableAction = "s3tables:GetConfig"
 
 	// S3TablesTableMetricsAction is a MinIO extension exposing table metrics.
-	S3TablesTableMetricsAction = "s3tables:TableMetrics"
+	S3TablesTableMetricsAction TableAction = "s3tables:TableMetrics"
 
 	// S3TablesUpdateTableAction is a MinIO extension for Iceberg-compatible table updates.
-	S3TablesUpdateTableAction = "s3tables:UpdateTable"
+	S3TablesUpdateTableAction TableAction = "s3tables:UpdateTable"
 
 	// S3TablesCreateViewAction is a MinIO extension for creating Iceberg views.
-	S3TablesCreateViewAction = "s3tables:CreateView"
+	S3TablesCreateViewAction TableAction = "s3tables:CreateView"
 
 	// S3TablesDeleteViewAction is a MinIO extension for deleting Iceberg views.
-	S3TablesDeleteViewAction = "s3tables:DeleteView"
+	S3TablesDeleteViewAction TableAction = "s3tables:DeleteView"
 
 	// S3TablesGetViewAction is a MinIO extension for retrieving Iceberg views.
-	S3TablesGetViewAction = "s3tables:GetView"
+	S3TablesGetViewAction TableAction = "s3tables:GetView"
 
 	// S3TablesRenameViewAction is a MinIO extension for renaming Iceberg views.
-	S3TablesRenameViewAction = "s3tables:RenameView"
+	S3TablesRenameViewAction TableAction = "s3tables:RenameView"
 
 	// S3TablesUpdateViewAction is a MinIO extension for updating Iceberg views.
-	S3TablesUpdateViewAction = "s3tables:UpdateView"
+	S3TablesUpdateViewAction TableAction = "s3tables:UpdateView"
 
 	// S3TablesListViewsAction is a MinIO extension for listing Iceberg views.
-	S3TablesListViewsAction = "s3tables:ListViews"
+	S3TablesListViewsAction TableAction = "s3tables:ListViews"
 
 	// S3TablesRegisterViewAction is a MinIO extension for registering Iceberg views.
-	S3TablesRegisterViewAction = "s3tables:RegisterView"
+	S3TablesRegisterViewAction TableAction = "s3tables:RegisterView"
 
 	// S3TablesCreateFunctionAction is a MinIO extension for creating Iceberg functions (SQL UDFs).
-	S3TablesCreateFunctionAction = "s3tables:CreateFunction"
+	S3TablesCreateFunctionAction TableAction = "s3tables:CreateFunction"
 
 	// S3TablesDeleteFunctionAction is a MinIO extension for deleting Iceberg functions (SQL UDFs).
-	S3TablesDeleteFunctionAction = "s3tables:DeleteFunction"
+	S3TablesDeleteFunctionAction TableAction = "s3tables:DeleteFunction"
 
 	// S3TablesGetFunctionAction is a MinIO extension for retrieving Iceberg functions (SQL UDFs).
-	S3TablesGetFunctionAction = "s3tables:GetFunction"
+	S3TablesGetFunctionAction TableAction = "s3tables:GetFunction"
 
 	// S3TablesRenameFunctionAction is a MinIO extension for renaming Iceberg functions (SQL UDFs).
-	S3TablesRenameFunctionAction = "s3tables:RenameFunction"
+	S3TablesRenameFunctionAction TableAction = "s3tables:RenameFunction"
 
 	// S3TablesUpdateFunctionAction is a MinIO extension for updating Iceberg functions (SQL UDFs).
-	S3TablesUpdateFunctionAction = "s3tables:UpdateFunction"
+	S3TablesUpdateFunctionAction TableAction = "s3tables:UpdateFunction"
 
 	// S3TablesListFunctionsAction is a MinIO extension for listing Iceberg functions (SQL UDFs).
-	S3TablesListFunctionsAction = "s3tables:ListFunctions"
+	S3TablesListFunctionsAction TableAction = "s3tables:ListFunctions"
 
 	// S3TablesRegisterFunctionAction is a MinIO extension for registering Iceberg functions (SQL UDFs).
-	S3TablesRegisterFunctionAction = "s3tables:RegisterFunction"
+	S3TablesRegisterFunctionAction TableAction = "s3tables:RegisterFunction"
 
 	// S3TablesUpdateNamespacePropertiesAction is a MinIO extension for updating namespace properties.
-	S3TablesUpdateNamespacePropertiesAction = "s3tables:UpdateNamespaceProperties"
+	S3TablesUpdateNamespacePropertiesAction TableAction = "s3tables:UpdateNamespaceProperties"
 
 	// S3TablesTagWarehouseAction is a MinIO extension for tagging Iceberg warehouses.
-	S3TablesTagWarehouseAction = "s3tables:TagWarehouse"
+	S3TablesTagWarehouseAction TableAction = "s3tables:TagWarehouse"
 	// S3TablesUntagWarehouseAction is a MinIO extension for removing tags from Iceberg warehouses.
-	S3TablesUntagWarehouseAction = "s3tables:UntagWarehouse"
+	S3TablesUntagWarehouseAction TableAction = "s3tables:UntagWarehouse"
 	// S3TablesListTagsForWarehouseAction is a MinIO extension for listing tags on Iceberg warehouses.
-	S3TablesListTagsForWarehouseAction = "s3tables:ListTagsForWarehouse"
+	S3TablesListTagsForWarehouseAction TableAction = "s3tables:ListTagsForWarehouse"
 
 	// S3TablesTagTableAction is a MinIO extension for tagging tables.
-	S3TablesTagTableAction = "s3tables:TagTable"
+	S3TablesTagTableAction TableAction = "s3tables:TagTable"
 	// S3TablesUntagTableAction is a MinIO extension for removing tags from tables.
-	S3TablesUntagTableAction = "s3tables:UntagTable"
+	S3TablesUntagTableAction TableAction = "s3tables:UntagTable"
 	// S3TablesListTagsForTableAction is a MinIO extension for listing tags on tables.
-	S3TablesListTagsForTableAction = "s3tables:ListTagsForTable"
+	S3TablesListTagsForTableAction TableAction = "s3tables:ListTagsForTable"
 
 	// AllS3TablesActions - all Amazon S3 Tables actions
-	AllS3TablesActions = "s3tables:*"
+	AllS3TablesActions TableAction = "s3tables:*"
 )
 
 // SupportedTableActions - list of all supported S3 Tables actions.
@@ -382,7 +382,7 @@ func createTableActionConditionKeyMap() map[Action]condition.KeySet {
 	}
 
 	// Override specific actions with their condition keys
-	tableActionConditionKeyMap[AllS3TablesActions] = withCommon(
+	tableActionConditionKeyMap[Action(AllS3TablesActions)] = withCommon(
 		s3TablesNamespaceKey,
 		s3TablesTableNameKey,
 		s3TablesViewNameKey,
@@ -393,76 +393,76 @@ func createTableActionConditionKeyMap() map[Action]condition.KeySet {
 		s3TablesWarehouseTagKey,
 		s3TablesTableTagKey,
 	)
-	tableActionConditionKeyMap[S3TablesCreateNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesCreateTableAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesTableNameKey, s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesCreateTableBucketAction] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesDeleteNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesDeleteTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetNamespaceAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesGetTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetTableDataAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableEncryptionAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMaintenanceConfigurationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMaintenanceJobStatusAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTableMetadataLocationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesGetTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesListNamespacesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesListTableBucketsAction] = withCommon()
-	tableActionConditionKeyMap[S3TablesListTablesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesPutTableBucketEncryptionAction] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutTableBucketMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutTableBucketPolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutTableDataAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesPutTableEncryptionAction] = withTableCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutTableMaintenanceConfigurationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesPutTablePolicyAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesRegisterTableAction] = withTableCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesRenameTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUpdateTableMetadataLocationAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesCreateWarehouseAction] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesDeleteWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteWarehouseEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesDeleteWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseEncryptionAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehouseMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesListWarehousesAction] = withCommon()
-	tableActionConditionKeyMap[S3TablesPutWarehouseEncryptionAction] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
-	tableActionConditionKeyMap[S3TablesPutWarehouseMaintenanceConfigurationAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesPutWarehousePolicyAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesGetConfigAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesTableMetricsAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUpdateTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesCreateViewAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesViewNameKey)
-	tableActionConditionKeyMap[S3TablesDeleteViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesGetViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesRenameViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesUpdateViewAction] = withViewCommon()
-	tableActionConditionKeyMap[S3TablesRegisterViewAction] = withViewCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesListViewsAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesCreateFunctionAction] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesFunctionNameKey)
-	tableActionConditionKeyMap[S3TablesDeleteFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesGetFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesRenameFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesUpdateFunctionAction] = withFunctionCommon()
-	tableActionConditionKeyMap[S3TablesRegisterFunctionAction] = withFunctionCommon(s3TablesRegisterLocationKey)
-	tableActionConditionKeyMap[S3TablesListFunctionsAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesUpdateNamespacePropertiesAction] = withWarehouseCommon(s3TablesNamespaceKey)
-	tableActionConditionKeyMap[S3TablesTagWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesUntagWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesListTagsForWarehouseAction] = withWarehouseCommon()
-	tableActionConditionKeyMap[S3TablesTagTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesUntagTableAction] = withTableCommon()
-	tableActionConditionKeyMap[S3TablesListTagsForTableAction] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateTableAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesTableNameKey, s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateTableBucketAction)] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetNamespaceAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesGetTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableDataAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableEncryptionAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMaintenanceConfigurationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMaintenanceJobStatusAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTableMetadataLocationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesListNamespacesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesListTableBucketsAction)] = withCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTablesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketEncryptionAction)] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableBucketPolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableDataAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTableEncryptionAction)] = withTableCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutTableMaintenanceConfigurationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutTablePolicyAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterTableAction)] = withTableCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesRenameTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateTableMetadataLocationAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateWarehouseAction)] = withCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehouseEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesDeleteWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseEncryptionAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehouseMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesListWarehousesAction)] = withCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutWarehouseEncryptionAction)] = withWarehouseCommon(s3TablesKMSKeyKey, s3TablesSSEAlgorithmKey)
+	tableActionConditionKeyMap[Action(S3TablesPutWarehouseMaintenanceConfigurationAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesPutWarehousePolicyAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetConfigAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesTableMetricsAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesCreateViewAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesViewNameKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesRenameViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateViewAction)] = withViewCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterViewAction)] = withViewCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesListViewsAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesCreateFunctionAction)] = withWarehouseCommon(s3TablesNamespaceKey, s3TablesFunctionNameKey)
+	tableActionConditionKeyMap[Action(S3TablesDeleteFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesGetFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesRenameFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesUpdateFunctionAction)] = withFunctionCommon()
+	tableActionConditionKeyMap[Action(S3TablesRegisterFunctionAction)] = withFunctionCommon(s3TablesRegisterLocationKey)
+	tableActionConditionKeyMap[Action(S3TablesListFunctionsAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesUpdateNamespacePropertiesAction)] = withWarehouseCommon(s3TablesNamespaceKey)
+	tableActionConditionKeyMap[Action(S3TablesTagWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesUntagWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTagsForWarehouseAction)] = withWarehouseCommon()
+	tableActionConditionKeyMap[Action(S3TablesTagTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesUntagTableAction)] = withTableCommon()
+	tableActionConditionKeyMap[Action(S3TablesListTagsForTableAction)] = withTableCommon()
 
 	return tableActionConditionKeyMap
 }
diff --git a/policy/vectors-action.go b/policy/vectors-action.go
index e6fd61d3..aa723575 100644
--- a/policy/vectors-action.go
+++ b/policy/vectors-action.go
@@ -29,43 +29,43 @@ const (
 	S3VectorsCreateVectorBucketAction VectorsAction = "s3vectors:CreateVectorBucket"
 
 	// S3VectorsDeleteVectorBucketAction maps to the AWS `DeleteVectorBucket` S3 Vectors action.
-	S3VectorsDeleteVectorBucketAction = "s3vectors:DeleteVectorBucket"
+	S3VectorsDeleteVectorBucketAction VectorsAction = "s3vectors:DeleteVectorBucket"
 
 	// S3VectorsGetVectorBucketAction maps to the AWS `GetVectorBucket` S3 Vectors action.
-	S3VectorsGetVectorBucketAction = "s3vectors:GetVectorBucket"
+	S3VectorsGetVectorBucketAction VectorsAction = "s3vectors:GetVectorBucket"
 
 	// S3VectorsListVectorBucketsAction maps to the AWS `ListVectorBuckets` S3 Vectors action.
-	S3VectorsListVectorBucketsAction = "s3vectors:ListVectorBuckets"
+	S3VectorsListVectorBucketsAction VectorsAction = "s3vectors:ListVectorBuckets"
 
 	// S3VectorsCreateIndexAction maps to the AWS `CreateIndex` S3 Vectors action.
-	S3VectorsCreateIndexAction = "s3vectors:CreateIndex"
+	S3VectorsCreateIndexAction VectorsAction = "s3vectors:CreateIndex"
 
 	// S3VectorsDeleteIndexAction maps to the AWS `DeleteIndex` S3 Vectors action.
-	S3VectorsDeleteIndexAction = "s3vectors:DeleteIndex"
+	S3VectorsDeleteIndexAction VectorsAction = "s3vectors:DeleteIndex"
 
 	// S3VectorsGetIndexAction maps to the AWS `GetIndex` S3 Vectors action.
-	S3VectorsGetIndexAction = "s3vectors:GetIndex"
+	S3VectorsGetIndexAction VectorsAction = "s3vectors:GetIndex"
 
 	// S3VectorsListIndexesAction maps to the AWS `ListIndexes` S3 Vectors action.
-	S3VectorsListIndexesAction = "s3vectors:ListIndexes"
+	S3VectorsListIndexesAction VectorsAction = "s3vectors:ListIndexes"
 
 	// S3VectorsPutVectorsAction maps to the AWS `PutVectors` S3 Vectors action.
-	S3VectorsPutVectorsAction = "s3vectors:PutVectors"
+	S3VectorsPutVectorsAction VectorsAction = "s3vectors:PutVectors"
 
 	// S3VectorsGetVectorsAction maps to the AWS `GetVectors` S3 Vectors action.
-	S3VectorsGetVectorsAction = "s3vectors:GetVectors"
+	S3VectorsGetVectorsAction VectorsAction = "s3vectors:GetVectors"
 
 	// S3VectorsDeleteVectorsAction maps to the AWS `DeleteVectors` S3 Vectors action.
-	S3VectorsDeleteVectorsAction = "s3vectors:DeleteVectors"
+	S3VectorsDeleteVectorsAction VectorsAction = "s3vectors:DeleteVectors"
 
 	// S3VectorsListVectorsAction maps to the AWS `ListVectors` S3 Vectors action.
-	S3VectorsListVectorsAction = "s3vectors:ListVectors"
+	S3VectorsListVectorsAction VectorsAction = "s3vectors:ListVectors"
 
 	// S3VectorsQueryVectorsAction maps to the AWS `QueryVectors` S3 Vectors action.
-	S3VectorsQueryVectorsAction = "s3vectors:QueryVectors"
+	S3VectorsQueryVectorsAction VectorsAction = "s3vectors:QueryVectors"
 
 	// AllS3VectorsActions - all Amazon S3 Vectors actions
-	AllS3VectorsActions = "s3vectors:*"
+	AllS3VectorsActions VectorsAction = "s3vectors:*"
 )
 
 // SupportedVectorsActions - list of all supported S3 Vectors actions.