diff --git modules/callbacks.inc modules/callbacks.inc
index 87243b1..466630e 100644
--- modules/callbacks.inc
+++ modules/callbacks.inc
@@ -515,6 +515,34 @@ function entity_metadata_user_access($op, $entity = NULL, $account = NULL, $enti
 }
 
 /**
+ * Access callback for restricted user properties.
+ */
+function entity_metadata_user_properties_access($op, $property, $entity = NULL, $account = NULL) {
+  if (user_access('administer users', $account)) {
+    return TRUE;
+  }
+  $account = isset($account) ? $account : $GLOBALS['user'];
+  // Flag to indicate if this user entity is the own user account.
+  $is_own_account = isset($entity) && $account->uid == $entity->uid;
+  switch ($property) {
+    case 'name':
+      // Allow view access to anyone with access to the entity.
+      if ($op == 'view') {
+        return TRUE;
+      }
+      // Alow edit access for own user name if the permission is satisfied.
+      return $is_own_account && user_access('change own username', $account);
+    case 'mail':
+      // Allow access to own mail address.
+      return $is_own_account;
+    case 'roles':
+      // Alow view access for own roles.
+      return ($op == 'view' && $is_own_account);
+  }
+  return FALSE;
+}
+
+/**
  * Access callback for the comment entity.
  */
 function entity_metadata_comment_access($op, $entity = NULL, $account = NULL) {
diff --git modules/user.info.inc modules/user.info.inc
index b25f412..144ca1e 100644
--- modules/user.info.inc
+++ modules/user.info.inc
@@ -27,6 +27,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_property_verbatim_set',
     'sanitize' => 'filter_xss',
     'required' => TRUE,
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   $properties['mail'] = array(
     'label' => t("Email"),
@@ -34,6 +35,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_property_verbatim_set',
     'validation callback' => 'valid_email_address',
     'required' => TRUE,
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   $properties['url'] = array(
     'label' => t("URL"),
@@ -66,6 +68,7 @@ function entity_metadata_user_entity_property_info() {
     'setter callback' => 'entity_metadata_user_set_properties',
     'setter permission' => 'administer users',
     'options list' => 'entity_metadata_user_roles',
+    'access callback' => 'entity_metadata_user_properties_access',
   );
   return $info;
 }