diff --git a/modules/invenio-deposit/invenio_deposit/views/rest.py b/modules/invenio-deposit/invenio_deposit/views/rest.py
index a0f0148d59..7d51b92f0a 100644
--- a/modules/invenio-deposit/invenio_deposit/views/rest.py
+++ b/modules/invenio-deposit/invenio_deposit/views/rest.py
@@ -142,6 +142,7 @@ def dbsession_clean(exception):
             options['item_route']: (
                 options.pop('update_decorators', []), ('PUT', 'PATCH')),
         }
+        action_decorators = options.pop('action_decorators', [])
 
         options.setdefault('search_class', DepositSearch)
         search_class = obj_or_import_string(options['search_class'])
@@ -192,6 +193,9 @@ def dbsession_clean(exception):
             pid_type=options['pid_type'],
             ctx=ctx,
         )
+        if action_decorators:
+            deposit_actions = decorate_view(
+                deposit_actions, action_decorators, ('POST',))
 
         blueprint.add_url_rule(
             '{0}/actions/<any({1}):action>'.format(
diff --git a/modules/invenio-deposit/tests/test_views_rest.py b/modules/invenio-deposit/tests/test_views_rest.py
index 7153dbf2ea..da29f0e1a3 100644
--- a/modules/invenio-deposit/tests/test_views_rest.py
+++ b/modules/invenio-deposit/tests/test_views_rest.py
@@ -675,6 +675,7 @@ def test_create_blueprint_route_decorators():
             default_media_type='application/json',
             create_decorators=[_abort_factory(418)],
             update_decorators=[_abort_factory(409)],
+            action_decorators=[_abort_factory(403)],
         )
     )
     app = Flask('testapp')
@@ -688,8 +689,12 @@ def test_create_blueprint_route_decorators():
         assert client.post('/deposits/').status_code == 418
         assert client.put('/deposits/1').status_code == 409
         assert client.patch('/deposits/1').status_code == 409
+        assert client.post('/deposits/1/actions/edit').status_code == 403
+        assert client.post('/deposits/1/actions/discard').status_code == 403
+        assert client.post('/deposits/1/actions/publish').status_code == 403
     assert 'create_decorators' in endpoints['depid']
     assert 'update_decorators' in endpoints['depid']
+    assert 'action_decorators' in endpoints['depid']
 
 
 def _abort_factory(code):
diff --git a/modules/weko-deposit/tests/test_weko_deposit.py b/modules/weko-deposit/tests/test_weko_deposit.py
index 7df8cc40f0..f378e902ef 100644
--- a/modules/weko-deposit/tests/test_weko_deposit.py
+++ b/modules/weko-deposit/tests/test_weko_deposit.py
@@ -78,9 +78,12 @@ def test_ItemResource_put(app, db):
         headers = {'content-type': 'application/json'}
         with patch('weko_deposit.tasks.RecordsSearch', mock_recordssearch), \
              patch("weko_deposit.rest.WekoRecord.get_record_by_pid", return_value=None):
+            # put には require_item_edit_permission が付いているため、
+            # 未認証では本体に入る前に 401 になる。
+            # ログイン後の更新の流れは test_rest.py::test_put で見ている。
             res = client.put("/deposits/redirect/1",
                             data=json.dumps(data), headers=headers)
-            assert res.status_code == 200
+            assert res.status_code == 401
 
 
 def test_deposit_rest_endpoints_route_decorators():
@@ -97,3 +100,6 @@ def test_deposit_rest_endpoints_route_decorators():
     assert DEPOSIT_REST_ENDPOINTS['depid']['update_decorators'] == expected
     assert WEKO_DEPOSIT_REST_ENDPOINTS['depid']['update_decorators'] \
         == expected
+    assert DEPOSIT_REST_ENDPOINTS['depid']['action_decorators'] == expected
+    assert WEKO_DEPOSIT_REST_ENDPOINTS['depid']['action_decorators'] \
+        == expected
diff --git a/modules/weko-deposit/weko_deposit/config.py b/modules/weko-deposit/weko_deposit/config.py
index f5e2edcdcb..8aca2ac45d 100644
--- a/modules/weko-deposit/weko_deposit/config.py
+++ b/modules/weko-deposit/weko_deposit/config.py
@@ -130,6 +130,7 @@
         delete_permission_factory_imp=deny_all,
         create_decorators=['weko_accounts.utils:login_required_customize'],
         update_decorators=['weko_deposit.rest:require_item_edit_permission'],
+        action_decorators=['weko_deposit.rest:require_item_edit_permission'],
     )
 )
 
diff --git a/scripts/instance.cfg b/scripts/instance.cfg
index 0f3ad4fd5b..66348587d6 100644
--- a/scripts/instance.cfg
+++ b/scripts/instance.cfg
@@ -765,9 +765,9 @@ WEKO_WORKFLOW_ENABLE_AUTO_SET_INDEX_FOR_ITEM_TYPE = True
 #--- Enable showing term of use
 WEKO_WORKFLOW_ENABLE_SHOWING_TERM_OF_USE = True
 #--- Enable issuing tokens for guest activities
-WEKO_WORKFLOW_GUEST_TOKEN_ISSUE_ENABLED = True
+WEKO_WORKFLOW_GUEST_TOKEN_ISSUE_ENABLED = False
 #--- Enable accepting tokens for guest activities
-WEKO_WORKFLOW_GUEST_TOKEN_ACCEPT_ENABLED = True
+WEKO_WORKFLOW_GUEST_TOKEN_ACCEPT_ENABLED = False
 
 from weko_user_profiles.config import WEKO_USERPROFILES_GENERAL_ROLE, WEKO_USERPROFILES_GRADUATED_STUDENT_ROLE, WEKO_USERPROFILES_STUDENT_ROLE