# How to Group Roles into a Custom Security Level in Ignition?

**URL:** <https://forum.inductiveautomation.com/t/how-to-group-roles-into-a-custom-security-level-in-ignition/105252>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [April 17, 2025, 6:04pm UTC](https://forum.inductiveautomation.com/t/how-to-group-roles-into-a-custom-security-level-in-ignition/105252 "2025-04-17T18:04:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Lino](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@Jose\_Lino](https://forum.inductiveautomation.com/u/Jose_Lino)\
**Post date:** [April 17, 2025, 6:04pm UTC](https://forum.inductiveautomation.com/t/how-to-group-roles-into-a-custom-security-level-in-ignition/105252/1 "2025-04-17T18:04:46Z")

</div>

**Hi Everyone,**

I've been working on setting up security settings similar to what PlantPAx uses (not exactly the same, but along the same lines).

My goal is to define multiple roles, such as:

- HMI\_Operators (A)
- HMI\_Operating Supervisor (B)
- HMI\_Maintenance (C)
- HMI\_Maintenance Supervisor (D)
- HMI\_Engineering (E)  
...and so on.

In addition to these, I want to create a custom role (or security tag) — for example, **AlarmAck** — that includes roles **C, D, and E** (i.e., HMI\_Maintenance, HMI\_Maintenance Supervisor, and HMI\_Engineering).

The idea is to simplify HMI authorization logic. So instead of writing something like:

```python
isAuthorized(true, "Authenticated/Roles/HMI_Maintenance", 
                  "Authenticated/Roles/HMI_Maintenance_Supervisor", 
                  "Authenticated/Roles/HMI_Engineering")

```

…I would like to just use:

```python
isAuthorized(true, "Authenticated/AlarmAck")

```

To do this, I tried creating a custom security level called **AlarmAck** and added security level rules with the following expression:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/6/f603826b1e6e2b2e83924c703f631dc3930f4289.png)

However, when I test `isAuthorized(true, "Authenticated/AlarmAck")`, it always returns `false`, indicating that I don’t have the required access.

Am I doing something wrong in how I'm setting up the security level rules?  
Is there a better or easier way to implement this type of role grouping in Ignition?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Chris\_Bingham](https://avatars.discourse-cdn.com/v4/letter/c/e5b9ba/32.png) [@Chris\_Bingham](https://forum.inductiveautomation.com/u/Chris_Bingham)\
**Post date:** [June 19, 2025, 12:32pm UTC](https://forum.inductiveautomation.com/t/how-to-group-roles-into-a-custom-security-level-in-ignition/105252/2 "2025-06-19T12:32:44Z")

</div>

(Sorry for the late reply…)

> [@Jose\_Lino](#):
>
> Is there a better or easier way to implement this type of role grouping

I prefer to make Ignition Security Levels which match AD groups 1:1, and enforce that preference. This is done to avoid future handcuffs, especially when adding new projects with new roles to our ecosystem. Your experience may differ…  
If you opt for 1:1, one option might be to also create an AlarmAck AD group which contains the other groups as members. Some IT personnel resist that temptation, which is why…  
For things like AlarmAck priv (if I recall correctly), I utilize an array tag on each (default) tag provider, with each element containing the Ignition-mapped roles listed therein, and reference that array tag in the `isAuthorized` expression, with a default value (via `coalesce`) of `false`.

> [@Jose\_Lino](#):
>
> Am I doing something wrong

Nothing jumped out me, so I’d recommend that you use the [Test Login](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/test-login-and-logout) feature on the same IDP that your project is using, then verify the roles and mappings there before jumping in to the runtime application.