A control that limits what an agent can see, say, decide, or do, which is enforced through policy, permissions, validation, or runtime checks.