# Clarification on service security policies

**URL:** <https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046>\
**Category:** Ignition\
**Created:** [June 18, 2026, 2:37am UTC](https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046 "2026-06-18T02:37:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![msmith](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@msmith](https://forum.inductiveautomation.com/u/msmith)\
**Post date:** [June 18, 2026, 2:37am UTC](https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046/1 "2026-06-18T02:37:09Z")

</div>

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/e/d/ed111101a5a9e890cc10585d5916f847ab11ea15.png)  
taken from this page:

> **[Service Security Policies | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.3/platform/security/service-security)**
>
> Policies can be defined for each Security Zone. Security Zones and their policies can be found within the Platform section of the Gateway under Security \> Zones.

Could someone please clarify, I presume that the note means the tag access section of the policy is meaningless if running on a single gateway (edge in this instance).

1. Does this mean if there is a remote gateway on the network that access to tags can be controlled through the policy when connected to the local gateway?
2. Is there any way to control access to prevent a certain zone from being able to edit tags if using only a single gateway?

---

<div class="post-metadata">

**Author:** ![hayden.watson](https://avatars.discourse-cdn.com/v4/letter/h/77aa72/32.png) [@hayden.watson](https://forum.inductiveautomation.com/u/hayden.watson)\
**Post date:** [June 18, 2026, 11:51am UTC](https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046/2 "2026-06-18T11:51:55Z")

</div>

If you have an ignition gateway connecting to your devices, and a second using that gateways tags you can limit access in the security policies.

If you want to read/write to tags on the same gateway this policy won't affect it, you need to configure the security on the tags themselves in the designer. See here: [Tag Security Properties | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/8.1/platform/tags/tag-properties/tag-security-properties)

---

<div class="post-metadata">

**Author:** ![msmith](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@msmith](https://forum.inductiveautomation.com/u/msmith)\
**Post date:** [June 18, 2026, 9:37pm UTC](https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046/3 "2026-06-18T21:37:43Z")

</div>

It's not a massive problem for me but I would be curious to know if it is possible to allow a user to read/write but not edit tags on the gateway.

---

<div class="post-metadata">

**Author:** ![hayden.watson](https://avatars.discourse-cdn.com/v4/letter/h/77aa72/32.png) [@hayden.watson](https://forum.inductiveautomation.com/u/hayden.watson)\
**Post date:** [June 22, 2026, 12:47pm UTC](https://forum.inductiveautomation.com/t/clarification-on-service-security-policies/116046/4 "2026-06-22T12:47:50Z")

</div>

If you want to limit editing the tags, you want to edit the settings in the Tag Provider.

See here:[Tag Provider Security | Ignition User Manual](https://www.docs.inductiveautomation.com/docs/7.9/security/tag-security/tag-provider-security)