Can I restrict which users or clients can trigger specific actions?

Yes. Each action has its own access control. Even if an agent has access to an action, it still respects user-level permissions.