diff --git a/app/controllers/access_levels_controller.rb b/app/controllers/access_levels_controller.rb
index d9ed4a07..c2e1d93a 100644
--- a/app/controllers/access_levels_controller.rb
+++ b/app/controllers/access_levels_controller.rb
@@ -36,7 +36,9 @@ def update
     authorize! :update, @event
     @access_level = @event.access_levels.find(params.require(:id))
 
-    flash.now[:error] = "Something went wrong updating the ticket" unless @access_level.update(access_level_params)
+    flash.now[:error] = "Something went wrong updating the ticket" unless @access_level.update(
+      @access_level.registrations? ? access_level_params_strict : access_level_params
+    )
 
     respond_with @access_level
   end
@@ -68,4 +70,8 @@ def toggle_visibility
   def access_level_params
     params.require(:access_level).permit(:name, :capacity, :price, :has_comment, :hidden, :permit)
   end
+
+  def access_level_params_strict
+    params.require(:access_level).permit(:name, :capacity)
+  end
 end
diff --git a/app/models/access_level.rb b/app/models/access_level.rb
index 9e0b445e..344d1c23 100644
--- a/app/models/access_level.rb
+++ b/app/models/access_level.rb
@@ -10,6 +10,12 @@ class AccessLevel < ApplicationRecord
   validates :price, presence: true, numericality: { only_integer: true, greater_than_or_equal_to: 0 }
   validates :capacity, numericality: { allow_nil: true, only_integer: true, greater_than: 0 }
 
+  validate do |access_level|
+    if access_level.capacity && access_level.registrations.count > access_level.capacity
+      access_level.errors.add "Registration", "count exceeds capacity."
+    end
+  end
+
   validate do |access_level|
     access_level.errors.add :event_id, "has no bank number." if access_level.price.positive? && access_level.event.bank_number.blank?
   end
@@ -23,6 +29,10 @@ def requires_login?
     !permit_everyone?
   end
 
+  def registrations?
+    registrations.count.positive?
+  end
+
   def name_with_price
     if price.positive?
       "#{name} - €#{format('%0.2f', price)}"
diff --git a/app/views/access_levels/_access_level.html.erb b/app/views/access_levels/_access_level.html.erb
index 3a808e95..b153a3a0 100644
--- a/app/views/access_levels/_access_level.html.erb
+++ b/app/views/access_levels/_access_level.html.erb
@@ -11,8 +11,8 @@
   <td>
     <div class="nowrap">
       <%= link_to raw(visibility_icon(access_level)), toggle_visibility_event_access_level_path(access_level.event, access_level), class: 'btn btn-xs btn-default', remote: true %>
+      <%= link_to raw('<i class="glyphicon glyphicon-edit"></i> Edit'), edit_event_access_level_path(access_level.event, access_level), class: 'btn btn-xs btn-default', remote: true %>
       <% unless access_level.registrations.any? or access_level.partners.any? %>
-        <%= link_to raw('<i class="glyphicon glyphicon-edit"></i> Edit'), edit_event_access_level_path(access_level.event, access_level), class: 'btn btn-xs btn-default', remote: true %>
         <%= link_to raw('<i class="glyphicon glyphicon-trash"></i> Delete'), event_access_level_path(access_level.event, access_level), class: 'btn btn-xs btn-danger', data: {confirm: 'Are you sure?'}, remote: true, method: :delete %>
       <% end %>
     </div>
diff --git a/app/views/access_levels/_form.html.erb b/app/views/access_levels/_form.html.erb
index ff826e1a..ce642853 100644
--- a/app/views/access_levels/_form.html.erb
+++ b/app/views/access_levels/_form.html.erb
@@ -2,12 +2,12 @@
   <%= form_for [object.event, object], remote: true do |f| %>
     <td><%= f.text_field :name, class: 'form-control' %></td>
     <td><%= f.number_field :capacity, class: 'form-control', placeholder: 0 %></td>
-    <td><%= f.text_field :price, value: nice_amount(f.object.price), class: 'form-control', placeholder: "0.00" %></td>
+    <td><%= f.text_field :price, value: nice_amount(f.object.price), class: 'form-control', placeholder: "0.00" , disabled: f.object.registrations? %></td>
     <td width="130px">
-      <%= f.collection_select :permit, AccessLevel.permits.keys, :itself, lambda {|k| translate(k)}, {}, class: 'form-control' %>
+      <%= f.collection_select :permit, AccessLevel.permits.keys, :itself, lambda {|k| translate(k)}, {}, class: 'form-control', disabled: f.object.registrations? %>
     </td>
-    <td><div class="checkbox"><%= f.check_box :has_comment %></div></td>
-    <td><div class="checkbox"><%= f.check_box :hidden %></div></td>
+    <td><div class="checkbox"><%= f.check_box :has_comment, disabled: f.object.registrations? %></div></td>
+    <td><div class="checkbox"><%= f.check_box :hidden, disabled: f.object.registrations? %></div></td>
     <td><%= f.button button_name, class: 'btn btn-sm btn-primary' %></td>
     <%= javascript_tag do %>
       var id = "#<% if button_name == 'Save' %>edit_<% end %><%= dom_id(f.object) %>";