enforce that actions can no longer "do something" on action creation

This doesn't play well with config load/priv drop and was not strictly
enforced in v7.