Controller action methods must be public (to be accessible via HTTP), should not be static (instance methods are required for context and dependency injection), and can have ref and out parameters. They cannot use generic type parameters directly as part of the method signature in the action invocation context.