diff --git a/e2e-test/java/org/alfresco/rest/workflow/tasks/UpdateTaskFullTestsBulk1.java b/e2e-test/java/org/alfresco/rest/workflow/tasks/UpdateTaskFullTestsBulk1.java
index 672fd4441..49497c376 100644
--- a/e2e-test/java/org/alfresco/rest/workflow/tasks/UpdateTaskFullTestsBulk1.java
+++ b/e2e-test/java/org/alfresco/rest/workflow/tasks/UpdateTaskFullTestsBulk1.java
@@ -143,8 +143,28 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task cannot be updated from status completed to delegated and response is 404")
-    public void taskCannotBeUpdatedFromCompletedToDelegated() throws Exception
+            description = "Verify owner cannot update task from status completed to delegated and response is 404")
+    public void ownerCannotUpdateTaskFromCompletedToDelegated() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("completed");
+        
+        restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("delegated");
+        restClient.assertStatusCodeIs(HttpStatus.METHOD_NOT_ALLOWED).assertLastError()
+            .containsErrorKey(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .containsSummary(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .descriptionURLIs(RestErrorModel.RESTAPIEXPLORER)
+            .stackTraceIs(RestErrorModel.STACKTRACE);
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify assignee cannot update task from status completed to delegated and response is 404")
+    public void assigneeCannotUpdateTaskFromCompletedToDelegated() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner)
             .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
@@ -163,8 +183,28 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task cannot be updated from status completed to resolved and response is 404")
-    public void taskCannotBeUpdatedFromCompletedToResolved() throws Exception
+            description = "Verify owner cannot update task from status completed to resolved and response is 404")
+    public void ownerCannotUpdateTaskFromCompletedToResolved() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("completed");
+        
+        restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("resolved");
+        restClient.assertStatusCodeIs(HttpStatus.METHOD_NOT_ALLOWED).assertLastError()
+            .containsErrorKey(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .containsSummary(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .descriptionURLIs(RestErrorModel.RESTAPIEXPLORER)
+            .stackTraceIs(RestErrorModel.STACKTRACE);
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify assignee cannot update task from status completed to resolved and response is 404")
+    public void assigneeCannotUpdateTaskFromCompletedToResolved() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner)
             .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
@@ -183,8 +223,28 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task cannot be updated from status completed to completed and response is 404")
-    public void taskCannotBeUpdatedFromCompletedToCompleted() throws Exception
+            description = "Verify owner cannot update task from status completed to completed and response is 404")
+    public void ownerCannotUpdateTaskFromCompletedToCompleted() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("completed");
+        
+        restClient.authenticateUser(owner)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
+        restClient.assertStatusCodeIs(HttpStatus.METHOD_NOT_ALLOWED).assertLastError()
+            .containsErrorKey(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .containsSummary(String.format(RestErrorModel.TASK_ALREADY_COMPLETED, taskModel.getId()))
+            .descriptionURLIs(RestErrorModel.RESTAPIEXPLORER)
+            .stackTraceIs(RestErrorModel.STACKTRACE);
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify assignee cannot update task from status completed to completed and response is 404")
+    public void assigneeCannotUpdateTaskFromCompletedToCompleted() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner)
             .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("completed");
@@ -203,8 +263,8 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task can be updated from status claimed to unclaimed and response is 200")
-    public void taskCanBeUpdatedFromClaimedToUnclaimed() throws Exception
+            description = "Verify owner can update task from status claimed to unclaimed and response is 200")
+    public void ownerCanUpdateTaskFromClaimedToUnclaimed() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
         restClient.assertStatusCodeIs(HttpStatus.OK);
@@ -219,8 +279,24 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task can be updated from status claimed to delegated and response is 200")
-    public void taskCanBeUpdatedFromClaimedToDelegated() throws Exception
+            description = "Verify assignee can update task from status claimed to unclaimed and response is 200")
+    public void assigneeCanUpdateTaskFromClaimedToUnclaimed() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("claimed");
+        
+        restTaskModel = restClient.authenticateUser(assigneeUser)
+            .withParams("select=state").withWorkflowAPI().usingTask(taskModel).updateTask("unclaimed");
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("unclaimed");
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify owner can update task from status claimed to delegated and response is 200")
+    public void ownerCanUpdateTaskFromClaimedToDelegated() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
         restClient.assertStatusCodeIs(HttpStatus.OK);
@@ -242,8 +318,31 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task can be updated from status claimed to resolved and response is 200")
-    public void taskCanBeUpdatedFromClaimedToResolved() throws Exception
+            description = "Verify assignee can update task from status claimed to delegated and response is 200")
+    public void assigneeCanUpdateTaskFromClaimedToDelegated() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("claimed");
+        
+        UserModel newAssignee = dataUser.createRandomTestUser();
+        JsonObject inputJson = JsonBodyGenerator.defineJSON()
+                .add("state", "delegated")
+                .add("assignee", newAssignee.getUsername()).build();
+        
+        restTaskModel = restClient.authenticateUser(assigneeUser)
+            .withParams("select=state,assignee").withWorkflowAPI().usingTask(taskModel).updateTask(inputJson);
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("delegated")
+            .and().field("assignee").is(newAssignee.getUsername());
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify owner can update task from status claimed to resolved and response is 200")
+    public void ownerCanUpdateTaskFromClaimedToResolved() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
         restClient.assertStatusCodeIs(HttpStatus.OK);
@@ -259,8 +358,25 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
     
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
-            description = "Verify task cannot be updated from status claimed to claimed and response is 200")
-    public void taskCannotBeUpdatedFromClaimedToClaimed() throws Exception
+            description = "Verify assignee can update task from status claimed to resolved and response is 200")
+    public void assigneeCanUpdateTaskFromClaimedToResolved() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("claimed");
+        
+        restTaskModel = restClient.authenticateUser(assigneeUser)
+            .withParams("select=state,assignee").withWorkflowAPI().usingTask(taskModel).updateTask("resolved");
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("resolved");
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify owner cannot update task from status claimed to claimed and response is 409")
+    public void ownerCannotUpdateTaskFromClaimedToClaimed() throws Exception
     {       
         restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
         restClient.assertStatusCodeIs(HttpStatus.OK);
@@ -276,6 +392,23 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
             .stackTraceIs(RestErrorModel.STACKTRACE);
     }
     
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify assignee can update task from status claimed to claimed and response is 200")
+    public void assigneeCanUpdateTaskFromClaimedToClaimed() throws Exception
+    {       
+        restTaskModel = restClient.authenticateUser(owner).withWorkflowAPI().usingTask(taskModel).getTask();
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("claimed");
+        
+        restTaskModel = restClient.authenticateUser(assigneeUser)
+            .withParams("select=state,assignee").withWorkflowAPI().usingTask(taskModel).updateTask("claimed");
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("id").is(taskModel.getId())
+            .and().field("state").is("claimed");
+    }
+    
     @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
     @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
             description = "Verify task owner can complete task with valid variables and response is 200")
@@ -304,4 +437,84 @@ public class UpdateTaskFullTestsBulk1 extends RestTest
             .and().field("type").is("d:int")
             .and().field("value").is(3);
     }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify task owner cannot complete task with empty variables array and response is 200")
+    public void taskOwnerCannotUpdateTaskWithEmptyVariablesArray() throws Exception
+    {      
+        JsonObject inputJson = JsonBodyGenerator.defineJSON()
+                .add("state", "completed")
+                .add("variables", JsonBodyGenerator.defineJSONArray()
+                                    ).build();
+        
+        restTaskModel = restClient.authenticateUser(owner)
+                .withParams("select=state,variables").withWorkflowAPI().usingTask(taskModel).updateTask(inputJson);
+        restClient.assertStatusCodeIs(HttpStatus.OK);
+        restTaskModel.assertThat().field("priority").is(1)
+            .and().field("state").is("completed")
+            .and().field("assignee").is(taskModel.getAssignee());
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+            description = "Verify task owner cannot complete task with empty variables json body and response is 200")
+    public void taskOwnerCannotUpdateTaskWithEmptyVariablesJsonBody() throws Exception
+    {      
+        JsonObject inputJson = JsonBodyGenerator.defineJSON()
+                .add("state", "completed")
+                .add("variables", JsonBodyGenerator.defineJSONArray()
+                        .add(JsonBodyGenerator.defineJSON().build())
+                                    ).build();
+        
+        restTaskModel = restClient.authenticateUser(owner)
+                .withParams("select=state,variables").withWorkflowAPI().usingTask(taskModel).updateTask(inputJson);
+        restClient.assertStatusCodeIs(HttpStatus.BAD_REQUEST).assertLastError()
+            .containsErrorKey(RestErrorModel.VARIABLE_NAME_REQUIRED)
+            .containsSummary(RestErrorModel.VARIABLE_NAME_REQUIRED);
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+        description = "Verify any user with no relation to task is forbidden to delegate other task with Rest API (403)")
+    public void anyUserIsForbiddenToDelegateOtherTask() throws Exception
+    {
+        UserModel anyUser= dataUser.createRandomTestUser();
+
+        restTaskModel = restClient.authenticateUser(anyUser).withWorkflowAPI().usingTask(taskModel).updateTask("delegated");
+        restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN).assertLastError().containsSummary("Permission was denied");
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+        description = "Verify any user with no relation to task is forbidden to resolve other task with Rest API (403)")
+    public void anyUserIsForbiddenToResolveOtherTask() throws Exception
+    {
+        UserModel anyUser= dataUser.createRandomTestUser();
+
+        restTaskModel = restClient.authenticateUser(anyUser).withWorkflowAPI().usingTask(taskModel).updateTask("resolved");
+        restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN).assertLastError().containsSummary("Permission was denied");
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+        description = "Verify any user with no relation to task is forbidden to claim other task with Rest API (403)")
+    public void anyUserIsForbiddenToClaimOtherTask() throws Exception
+    {
+        UserModel anyUser= dataUser.createRandomTestUser();
+
+        restTaskModel = restClient.authenticateUser(anyUser).withWorkflowAPI().usingTask(taskModel).updateTask("claimed");
+        restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN).assertLastError().containsSummary("Permission was denied");
+    }
+    
+    @Test(groups = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS, TestGroup.FULL })
+    @TestRail(section = { TestGroup.REST_API, TestGroup.WORKFLOW, TestGroup.TASKS }, executionType = ExecutionType.REGRESSION, 
+        description = "Verify any user with no relation to task is forbidden to unclaim other task with Rest API (403)")
+    public void anyUserIsForbiddenToUnclaimOtherTask() throws Exception
+    {
+        UserModel anyUser= dataUser.createRandomTestUser();
+
+        restTaskModel = restClient.authenticateUser(anyUser).withWorkflowAPI().usingTask(taskModel).updateTask("unclaimed");
+        restClient.assertStatusCodeIs(HttpStatus.FORBIDDEN).assertLastError().containsSummary("Permission was denied");
+    }
 }