Define permissions for Actions?
For D7, I can see two answer depending on what behaviour you prefer:


VBO has a sub-module action permissions.  Enable this and it creates a permission for each action - see module page.  If the user lacks permission then the action is not even available for them.
If you need more granular permission that depends on the entity, then the "function which performs the action" can enforce it.  For example see views_bulk_operations_user_roles_action.  If the user lacks permission for some of the entities then the action won't take effect for those entities.  However there is typically not really any feedback to tell the user.


For D8, there is ActionInterface::access, see docs.