diff --git a/core/modules/action/action.routing.yml b/core/modules/action/action.routing.yml
index acb533a..15e8267 100644
--- a/core/modules/action/action.routing.yml
+++ b/core/modules/action/action.routing.yml
@@ -12,7 +12,7 @@ action.admin_add:
     _entity_form: 'action.add'
     _title: 'Add'
   requirements:
-    _permission: 'administer actions'
+    _entity_create_access: 'action'
 
 entity.action.edit_form:
   path: '/admin/config/system/actions/configure/{action}'
@@ -20,7 +20,7 @@ entity.action.edit_form:
     _entity_form: 'action.edit'
     _title: 'Edit'
   requirements:
-    _permission: 'administer actions'
+    _entity_access: 'action.update'
 
 entity.action.delete_form:
   path: '/admin/config/system/actions/configure/{action}/delete'
@@ -28,5 +28,5 @@ entity.action.delete_form:
     _entity_form: 'action.delete'
     _title: 'Delete'
   requirements:
-    _permission: 'administer actions'
+    _entity_access: 'action.delete'
 
diff --git a/core/modules/comment/config/install/system.action.comment_publish_action.yml b/core/modules/comment/config/install/system.action.comment_publish_action.yml
index 8fbd48d..3273cd1 100644
--- a/core/modules/comment/config/install/system.action.comment_publish_action.yml
+++ b/core/modules/comment/config/install/system.action.comment_publish_action.yml
@@ -7,4 +7,5 @@ id: comment_publish_action
 label: 'Publish comment'
 type: comment
 plugin: comment_publish_action
+locked: false
 configuration: {  }
diff --git a/core/modules/comment/config/install/system.action.comment_save_action.yml b/core/modules/comment/config/install/system.action.comment_save_action.yml
index 640d281..0043ec3 100644
--- a/core/modules/comment/config/install/system.action.comment_save_action.yml
+++ b/core/modules/comment/config/install/system.action.comment_save_action.yml
@@ -7,4 +7,5 @@ id: comment_save_action
 label: 'Save comment'
 type: comment
 plugin: comment_save_action
+locked: false
 configuration: {  }
diff --git a/core/modules/comment/config/install/system.action.comment_unpublish_action.yml b/core/modules/comment/config/install/system.action.comment_unpublish_action.yml
index 99902e8..7fc7ab7 100644
--- a/core/modules/comment/config/install/system.action.comment_unpublish_action.yml
+++ b/core/modules/comment/config/install/system.action.comment_unpublish_action.yml
@@ -7,4 +7,5 @@ id: comment_unpublish_action
 label: 'Unpublish comment'
 type: comment
 plugin: comment_unpublish_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_delete_action.yml b/core/modules/node/config/install/system.action.node_delete_action.yml
index 97662dc..d5c12e0 100644
--- a/core/modules/node/config/install/system.action.node_delete_action.yml
+++ b/core/modules/node/config/install/system.action.node_delete_action.yml
@@ -7,4 +7,5 @@ id: node_delete_action
 label: 'Delete content'
 type: node
 plugin: node_delete_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_make_sticky_action.yml b/core/modules/node/config/install/system.action.node_make_sticky_action.yml
index 94a81bf..f1b83c1 100644
--- a/core/modules/node/config/install/system.action.node_make_sticky_action.yml
+++ b/core/modules/node/config/install/system.action.node_make_sticky_action.yml
@@ -7,4 +7,5 @@ id: node_make_sticky_action
 label: 'Make content sticky'
 type: node
 plugin: node_make_sticky_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_make_unsticky_action.yml b/core/modules/node/config/install/system.action.node_make_unsticky_action.yml
index 6572963..290649b 100644
--- a/core/modules/node/config/install/system.action.node_make_unsticky_action.yml
+++ b/core/modules/node/config/install/system.action.node_make_unsticky_action.yml
@@ -7,4 +7,5 @@ id: node_make_unsticky_action
 label: 'Make content unsticky'
 type: node
 plugin: node_make_unsticky_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_promote_action.yml b/core/modules/node/config/install/system.action.node_promote_action.yml
index 7c45a42..5e8ec7a 100644
--- a/core/modules/node/config/install/system.action.node_promote_action.yml
+++ b/core/modules/node/config/install/system.action.node_promote_action.yml
@@ -7,4 +7,5 @@ id: node_promote_action
 label: 'Promote content to front page'
 type: node
 plugin: node_promote_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_publish_action.yml b/core/modules/node/config/install/system.action.node_publish_action.yml
index 20ed19b..fc1a7aa 100644
--- a/core/modules/node/config/install/system.action.node_publish_action.yml
+++ b/core/modules/node/config/install/system.action.node_publish_action.yml
@@ -7,4 +7,5 @@ id: node_publish_action
 label: 'Publish content'
 type: node
 plugin: node_publish_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_save_action.yml b/core/modules/node/config/install/system.action.node_save_action.yml
index 887ff43..f6566fb 100644
--- a/core/modules/node/config/install/system.action.node_save_action.yml
+++ b/core/modules/node/config/install/system.action.node_save_action.yml
@@ -7,4 +7,5 @@ id: node_save_action
 label: 'Save content'
 type: node
 plugin: node_save_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_unpromote_action.yml b/core/modules/node/config/install/system.action.node_unpromote_action.yml
index cb290dd..e26fa34 100644
--- a/core/modules/node/config/install/system.action.node_unpromote_action.yml
+++ b/core/modules/node/config/install/system.action.node_unpromote_action.yml
@@ -7,4 +7,5 @@ id: node_unpromote_action
 label: 'Remove content from front page'
 type: node
 plugin: node_unpromote_action
+locked: false
 configuration: {  }
diff --git a/core/modules/node/config/install/system.action.node_unpublish_action.yml b/core/modules/node/config/install/system.action.node_unpublish_action.yml
index 1e778c0..82c78e5 100644
--- a/core/modules/node/config/install/system.action.node_unpublish_action.yml
+++ b/core/modules/node/config/install/system.action.node_unpublish_action.yml
@@ -7,4 +7,5 @@ id: node_unpublish_action
 label: 'Unpublish content'
 type: node
 plugin: node_unpublish_action
+locked: false
 configuration: {  }
diff --git a/core/modules/system/config/schema/system.schema.yml b/core/modules/system/config/schema/system.schema.yml
index a6f61b6..41613e2 100644
--- a/core/modules/system/config/schema/system.schema.yml
+++ b/core/modules/system/config/schema/system.schema.yml
@@ -258,6 +258,9 @@ system.action.*:
     plugin:
       type: string
       label: 'Plugin'
+    locked:
+      type: boolean
+      label: 'Is locked'
     configuration:
       type: action.configuration.[%parent.plugin]
 
diff --git a/core/modules/system/src/Entity/Action.php b/core/modules/system/src/Entity/Action.php
index a412838..fa4e75d 100644
--- a/core/modules/system/src/Entity/Action.php
+++ b/core/modules/system/src/Entity/Action.php
@@ -15,6 +15,9 @@
  * @ConfigEntityType(
  *   id = "action",
  *   label = @Translation("Action"),
+ *   handlers = {
+ *     "access" = "Drupal\system\Entity\ActionAccess",
+ *   },
  *   admin_permission = "administer actions",
  *   entity_keys = {
  *     "id" = "id",
@@ -25,6 +28,7 @@
  *     "label",
  *     "type",
  *     "plugin",
+ *     "locked",
  *     "configuration",
  *   }
  * )
@@ -53,6 +57,13 @@ class Action extends ConfigEntityBase implements ActionConfigEntityInterface, En
   protected $type;
 
   /**
+   * Flag indicating whether the config entity is available for editing.
+   *
+   * @var bool
+   */
+  protected $locked = FALSE;
+
+  /**
    * The configuration of the action.
    *
    * @var array
@@ -132,6 +143,21 @@ public function isConfigurable() {
   /**
    * {@inheritdoc}
    */
+  public function isLocked() {
+    return (bool) $this->locked;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function setLocked($locked = TRUE) {
+    $this->locked = $locked;
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   public function getType() {
     return $this->type;
   }
diff --git a/core/modules/system/src/Entity/ActionAccess.php b/core/modules/system/src/Entity/ActionAccess.php
new file mode 100644
index 0000000..3017ea0
--- /dev/null
+++ b/core/modules/system/src/Entity/ActionAccess.php
@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\system\Entity\ActionAccess.
+ */
+
+namespace Drupal\system\Entity;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Entity\EntityAccessControlHandler;
+use Drupal\Core\Entity\EntityInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Defines the access control handler for the action entity type.
+ */
+class ActionAccess extends EntityAccessControlHandler {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
+    /** @var \Drupal\system\ActionConfigEntityInterface $entity */
+    if ($operation === 'update' && $entity->isLocked()) {
+      return AccessResult::forbidden()->addCacheableDependency($entity);
+    }
+    return parent::checkAccess($entity, $operation, $account);
+  }
+
+}
diff --git a/core/modules/user/config/install/system.action.user_block_user_action.yml b/core/modules/user/config/install/system.action.user_block_user_action.yml
index d9753bc..e146e8e 100644
--- a/core/modules/user/config/install/system.action.user_block_user_action.yml
+++ b/core/modules/user/config/install/system.action.user_block_user_action.yml
@@ -7,4 +7,5 @@ id: user_block_user_action
 label: 'Block the selected user(s)'
 type: user
 plugin: user_block_user_action
+locked: false
 configuration: {  }
diff --git a/core/modules/user/config/install/system.action.user_cancel_user_action.yml b/core/modules/user/config/install/system.action.user_cancel_user_action.yml
index cd90ff2..9bdcba4 100644
--- a/core/modules/user/config/install/system.action.user_cancel_user_action.yml
+++ b/core/modules/user/config/install/system.action.user_cancel_user_action.yml
@@ -7,4 +7,5 @@ id: user_cancel_user_action
 label: 'Cancel the selected user account(s)'
 type: user
 plugin: user_cancel_user_action
+locked: false
 configuration: {  }
diff --git a/core/modules/user/config/install/system.action.user_unblock_user_action.yml b/core/modules/user/config/install/system.action.user_unblock_user_action.yml
index 406edb2..21f774a 100644
--- a/core/modules/user/config/install/system.action.user_unblock_user_action.yml
+++ b/core/modules/user/config/install/system.action.user_unblock_user_action.yml
@@ -7,4 +7,5 @@ id: user_unblock_user_action
 label: 'Unblock the selected user(s)'
 type: user
 plugin: user_unblock_user_action
+locked: false
 configuration: {  }
diff --git a/core/modules/user/src/Tests/UserRoleActionsTest.php b/core/modules/user/src/Tests/UserRoleActionsTest.php
new file mode 100644
index 0000000..3e98730
--- /dev/null
+++ b/core/modules/user/src/Tests/UserRoleActionsTest.php
@@ -0,0 +1,57 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\user\Tests\UserRoleActionsTest.
+ */
+
+namespace Drupal\user\Tests;
+
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Tests editing actions auto-created for roles.
+ *
+ * @group user
+ */
+class UserRoleActionsTest extends WebTestBase {
+
+  /**
+   * User with admin privileges.
+   *
+   * @var \Drupal\user\UserInterface
+   */
+  protected $adminUser;
+
+  /**
+   * Modules to enable.
+   *
+   * @var string[]
+   */
+  public static $modules = ['action'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+    $this->adminUser = $this->drupalCreateUser(['administer permissions', 'administer users', 'administer actions']);
+  }
+
+  /**
+   * Tests editing actions added by user_user_role_insert().
+   */
+  public function testRoleActionAdministration() {
+    $this->drupalLogin($this->adminUser);
+
+    // Add a role.
+    $role_name = 'action_test';
+    $edit = ['label' => $role_name, 'id' => $role_name];
+    $this->drupalPostForm('admin/people/roles/add', $edit, t('Save'));
+
+    // Attempt to edit a locked role.
+    $this->drupalGet('admin/config/system/actions/configure/user_add_role_action.action_test');
+    $this->assertResponse(403);
+  }
+
+}
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 2d7d24a..8de7227 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -1016,6 +1016,7 @@ function user_user_role_insert(RoleInterface $role) {
         'rid' => $role->id(),
       ],
       'plugin' => 'user_add_role_action',
+      'locked' => TRUE,
     ]);
     $action->trustData()->save();
   }
@@ -1029,6 +1030,7 @@ function user_user_role_insert(RoleInterface $role) {
         'rid' => $role->id(),
       ],
       'plugin' => 'user_remove_role_action',
+      'locked' => TRUE,
     ]);
     $action->trustData()->save();
   }