# New Tag Permissions Model based on Security Levels

**URL:** <https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558>\
**Category:** Ignition Early Access\
**Created:** [May 8, 2020, 1:50am UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558 "2020-05-08T01:50:54Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![mazeyrat](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mazeyrat/32/10955_2.png) [@mazeyrat](https://forum.inductiveautomation.com/u/mazeyrat)\
**Post date:** [June 19, 2020, 2:15pm UTC](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558/4 "2020-06-19T14:15:44Z")

</div>

+1

I have same needs.  
I have converted all my generated udt with the new tag permission format for Ignition 8.0.13+  
For checking if write operation is authorized for a tag with scripting, you will had to read the tag properties **writePermissions and readOnly** and use something ugly like that to obtain roles and compare it to the logged user roles...

```auto
def getRoleFromTagPermission(permission):
	"""	
	Example :	
	  "writePermissions": {
		"type": "AnyOf",
		"securityLevels": [
		  {
			"name": "Authenticated",
			"children": [
			  {
				"name": "Roles",
				"children": [
				  {
					"name": "BIL_param",
					"children": []
				  },
				  {
					"name": "GTC_visu",
					"children": []
				  }				  
				]
			  }
			]
		  }		  
		"readPermissions": {
		  	"type": "AnyOf",
		  	"securityLevels": []
		}		  
	"""
	global strLib
	strFct="getRoleFromTagPermission"	
	try:
		result = []
		if ((permission != None) and (permission != "")):
			#<type 'com.inductiveautomation.ignition.common.auth.permissions.PermissionsConfig$AnyOfPermissionsConfig'>	
			#if type(permission)==AnyOfPermissionsConfig:
			json = permission.toJsonTree()
			if json != None:
				if "securityLevels" in json:
					securityLevels = json["securityLevels"]
					if securityLevels != None:
						if len(securityLevels)>0:
							roles = securityLevels[0]["children"][0]["children"]
							for role in roles:
								result.append(role["name"])
	except:
		shared.commun.logger.logERROR(strFct=strFct,strLib=strLib,strLog="GTC_Tag")
	return result

```

@jspecht  
If there is a way to obtain the securitylevels of the user, there is an isAuthorized function to check the permission.

> [@Reag tag's role and zone (tag with custom AccessRight)](http://forum.inductiveautomation.com/t/reag-tags-role-and-zone-tag-with-custom-accessright/20192/6):
>
> Thanks for bringing up the access problem! I’m in the process of republishing the 8.0.13 javadocs, should be fixed within the next 10-15 minutes. Please let me know if you continue to see issues after that.

---

_[View the full topic](https://forum.inductiveautomation.com/t/new-tag-permissions-model-based-on-security-levels/34558)._