This is the specific permit-or-deny action applied to traffic that matches this individual rule's criteria, as distinct from cienaCesAclProfileDefaultFilterAction which only applies to traffic matching no rule at all. An admin sets this per-rule to build up the actual security logic of a profile -- a mix of specific deny rules for known-bad traffic combined with a default-permit fallback, or specific permit rules layered over a default-deny fallback, are two fundamentally different but both common ACL design patterns. For example, a rule matching a known-malicious source subnet with this object set to deny, combined with a profile-level default action of permit, implements a classic 'block the bad, allow everything else' policy.