need to protect against direct access to .actions