The Disabled Actions field is populated on a key message, but the rep is still able to take those actions.
If the end-user does not have at least Read access to that field either at the Permission Set or Profile Level, the actions are allowed. There is no way for the application to tell that the settings are disabled without being able to access the field.
Provide the user Read access to that field at either the Profile or Permission Set level. If it is provided using a permission set, be sure Permission Set Support is enabled as well.
CRM Help Documentation: