# Custom Tag Security with Zones

**URL:** <https://forum.inductiveautomation.com/t/custom-tag-security-with-zones/25641>\
**Category:** Ignition\
**Created:** [June 7, 2019, 3:18pm UTC](https://forum.inductiveautomation.com/t/custom-tag-security-with-zones/25641 "2019-06-07T15:18:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abishur](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/abishur/32/9096_2.png) [@abishur](https://forum.inductiveautomation.com/u/abishur)\
**Post date:** [June 7, 2019, 3:18pm UTC](https://forum.inductiveautomation.com/t/custom-tag-security-with-zones/25641/1 "2019-06-07T15:18:46Z")

</div>

I’ve configured Security Zones on the gateway to only allow read/write access on the local network.

When I go to setup tag security on my UDT I see it has a note that “leaving the zone blank means any security zone satisfies the requirement”.

I’m assuming that the gateway settings will trump any security zone setting on the individual tag, but I wanted to confirm first.

---

<div class="post-metadata">

**Author:** ![mgross](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mgross/32/3311_2.png) [@mgross](https://forum.inductiveautomation.com/u/mgross)\
**Post date:** [June 7, 2019, 4:30pm UTC](https://forum.inductiveautomation.com/t/custom-tag-security-with-zones/25641/2 "2019-06-07T16:30:39Z")

</div>

Yes, that is correct (assuming that the default security zone is set to read-only). Only tags that make it past the initial security check will have their individual permissions checked.