diff --git a/src/agents/agents.controller.ts b/src/agents/agents.controller.ts
index b40f460..ad96858 100644
--- a/src/agents/agents.controller.ts
+++ b/src/agents/agents.controller.ts
@@ -25,6 +25,7 @@ import {
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { RolesGuard } from '../auth/guards/roles.guard';
 import { Roles } from '../auth/decorators/roles.decorator';
+import { Public } from '../auth/decorators/public.decorator';
 import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import { UserRole } from '@prisma/client';
 
@@ -33,9 +34,10 @@ import { UserRole } from '@prisma/client';
 export class AgentsController {
   constructor(private readonly agentsService: AgentsService) {}
 
-  // Public endpoints
+  // Public endpoints - accessible by anyone
 
   @Get()
+  @Public()
   @ApiOperation({ summary: 'Search and list agents' })
   @ApiResponse({ status: 200, description: 'Agents retrieved successfully' })
   async searchAgents(@Query() dto: SearchAgentsDto) {
@@ -43,6 +45,7 @@ export class AgentsController {
   }
 
   @Get('featured')
+  @Public()
   @ApiOperation({ summary: 'Get featured agents' })
   @ApiResponse({
     status: 200,
@@ -53,6 +56,7 @@ export class AgentsController {
   }
 
   @Get('top-rated')
+  @Public()
   @ApiOperation({ summary: 'Get top rated agents' })
   @ApiResponse({
     status: 200,
@@ -62,10 +66,11 @@ export class AgentsController {
     return this.agentsService.getTopRatedAgents(limit || 10);
   }
 
-  // Authenticated endpoints - must come before :id route
+  // Agent-only endpoints - requires AGENT role
 
   @Get('profile/me')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Get current user agent profile' })
   @ApiResponse({ status: 200, description: 'Profile retrieved successfully' })
@@ -74,8 +79,9 @@ export class AgentsController {
     return this.agentsService.getProfile(userId);
   }
 
-  // Parameterized route - must come after specific routes
+  // Public parameterized route - must come after specific routes
   @Get(':id')
+  @Public()
   @ApiOperation({ summary: 'Get agent profile by ID' })
   @ApiResponse({ status: 200, description: 'Agent profile retrieved successfully' })
   @ApiResponse({ status: 404, description: 'Agent profile not found' })
@@ -84,7 +90,8 @@ export class AgentsController {
   }
 
   @Post('profile')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Create agent profile' })
   @ApiResponse({ status: 201, description: 'Profile created successfully' })
@@ -97,7 +104,8 @@ export class AgentsController {
   }
 
   @Put('profile')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Update current user agent profile' })
   @ApiResponse({ status: 200, description: 'Profile updated successfully' })
diff --git a/src/upload/upload.controller.ts b/src/upload/upload.controller.ts
index 840e01d..ec720e8 100644
--- a/src/upload/upload.controller.ts
+++ b/src/upload/upload.controller.ts
@@ -15,10 +15,14 @@ import {
 import { UploadService } from './upload.service';
 import { PresignedUrlDto, PresignedUrlResponseDto } from './dto';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { RolesGuard } from '../auth/guards/roles.guard';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { UserRole } from '@prisma/client';
 
 @ApiTags('upload')
 @Controller('upload')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, RolesGuard)
+@Roles(UserRole.AGENT, UserRole.ADMIN)
 @ApiBearerAuth()
 export class UploadController {
   constructor(private readonly uploadService: UploadService) {}
diff --git a/src/verification/verification.controller.ts b/src/verification/verification.controller.ts
index ef8aa0c..ac6e507 100644
--- a/src/verification/verification.controller.ts
+++ b/src/verification/verification.controller.ts
@@ -33,10 +33,11 @@ import { UserRole } from '@prisma/client';
 export class VerificationController {
   constructor(private readonly verificationService: VerificationService) {}
 
-  // Agent endpoints
+  // Agent-only endpoints - requires AGENT role
 
   @Post('request')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Submit a verification request' })
   @ApiResponse({ status: 201, description: 'Request submitted successfully' })
@@ -50,7 +51,8 @@ export class VerificationController {
   }
 
   @Get('my-requests')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Get my verification requests' })
   @ApiResponse({ status: 200, description: 'Requests retrieved successfully' })
@@ -59,7 +61,8 @@ export class VerificationController {
   }
 
   @Get('request/:id')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Get verification request by ID' })
   @ApiResponse({ status: 200, description: 'Request retrieved successfully' })
@@ -73,7 +76,8 @@ export class VerificationController {
   }
 
   @Delete('request/:id')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.AGENT)
   @ApiBearerAuth()
   @ApiOperation({ summary: 'Cancel a pending verification request' })
   @ApiResponse({ status: 200, description: 'Request cancelled successfully' })