# Reviewing Ignition Resources Security **URL:** \ **Category:** Ignition\ **Created:** [March 30, 2026, 3:10pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771 "2026-03-30T15:10:40Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\ **Post date:** [March 30, 2026, 3:10pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/1 "2026-03-30T15:10:40Z")
Can you authorized which user can access Project A vs Project B Designer? ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 30, 2026, 3:16pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/2 "2026-03-30T15:16:38Z")
> **[Protecting Project Resources​ - Project Security in the Designer | Ignition User...](https://www.docs.inductiveautomation.com/docs/8.1/platform/security/project-security-in-the-designer#protecting-project-resources)** > > When several users are all working on the same project, managing changes to the project can become cumbersome. By default, all users with Designer access can modify, delete, save, and publish all resources available in the Designer. In some... ---
**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\ **Post date:** [March 30, 2026, 3:19pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/3 "2026-03-30T15:19:43Z")
Thanks, a million. I will look at this.. - See if this is the one I am needing. ---
**Author:** ![ryan.white](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/ryan.white/32/73193_2.png) [@ryan.white](https://forum.inductiveautomation.com/u/ryan.white)\ **Post date:** [March 30, 2026, 3:21pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/4 "2026-03-30T15:21:28Z")
The video listed at the start of the section shows how to configure the allowed access level, which seems to be missing from the manual. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [March 30, 2026, 3:45pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/5 "2026-03-30T15:45:26Z")
But keep in mind that **any** designer access can run code on the gateway, and thereby subvert any project-specific restrictions. Those are guardrails, not cages. ---
**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\ **Post date:** [April 1, 2026, 1:34am UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/6 "2026-04-01T01:34:28Z")
I am confused. Which permission does what? Project Permission (what are possible value Idp roles or security level) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/c/4ca7f5799fadf44f5302c01dea1aa11e00f6fad3.png) vs Perspective Permission ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/e/9ed93cd3dd6aa07e48eed46dee04b3238b958519.png) ~~Testing. When I tick `Ign_Write`, I Expect user other than Ign\_Write, not able to login to perspective. But Must still able to login to Project Via Designer? (but in actual does not) why?~~ ---
**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\ **Post date:** [April 1, 2026, 12:39pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/7 "2026-04-01T12:39:30Z")
Thanks, I got it.. To assign "IdP" roles to the Project Permissions (View, Save, Delete, Protect Resource). The current user, putting roles, must have these roles too. - of course! ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/4/543aeb00e7b4ebcc686c882a236c1a72fcc1e788.png) ---
**Author:** ![Eugene49](https://avatars.discourse-cdn.com/v4/letter/e/c6cbf5/32.png) [@Eugene49](https://forum.inductiveautomation.com/u/Eugene49)\ **Post date:** [April 6, 2026, 10:59pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/8 "2026-04-06T22:59:29Z")
Wait, Using Ignition User Source, as Identity Provider. A developer is not an admin. But he can run code to create new user `system.user.addUser` via designer and set role as an Administrator? Is it?? ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [April 6, 2026, 11:04pm UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/9 "2026-04-06T23:04:50Z")
> [@pturmel](#): > > But keep in mind that **any** designer access can run code on the gateway, and thereby subvert any project-specific restrictions. Those are guardrails, not cages. Yes. A user given access to the designer can run **arbitrary code on your gateway**. Nevermind giving themselves admin - they can run `system.util.execute` and launch arbitrary processes on the server. This is fundamental to the way Ignition works. Don't let users you don't trust into the designer. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [April 7, 2026, 7:37am UTC](https://forum.inductiveautomation.com/t/reviewing-ignition-resources-security/114771/10 "2026-04-07T07:37:30Z")
> [@Eugene49](#): > > Is it?? This comes up when trying to deploy Ignition as a multi-tenant application, and the workload is too much for the host organization. So they try to figure out how to let the tenants use the designer, and get themselves in **big** trouble. You simply cannot allow people who aren't trusted with total gateway access to use the designer. Designer roles and restrictions are assistance with **administrative** barriers, not secure barriers.