The obvious path with composer is to create a combinator for invoking a URL, which could treat web actions intrinsically.
This discussion has come up before - there’s also this related open issue on the topic [1]. An alternative would be fine grained privileges on assets where the default rights today are CRUD+Activate. [1] https://github.com/apache/incubator-openwhisk/issues/2155 -r
