When would you use a Server Action instead of a Route Handler?

I define transaction, idempotency, replay, and audit requirements independently of the transport. Actions use POST and have framework protections such as origin checks, but that is not business authorization and does not prevent duplicate user intent. Route Handlers are easier to version and observe as public APIs, while actions can reduce client plumbing for tightly coupled product flows. I test each boundary through its real transport, then test the shared domain operation separately so framework migration does not own the business rule.