# Security Level Parent/Child

**URL:** <https://forum.inductiveautomation.com/t/security-level-parent-child/110563>\
**Category:** Ignition 8.3 Early Access\
**Created:** [September 12, 2025, 7:17am UTC](https://forum.inductiveautomation.com/t/security-level-parent-child/110563 "2025-09-12T07:17:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco.handle](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@marco.handle](https://forum.inductiveautomation.com/u/marco.handle)\
**Post date:** [September 12, 2025, 7:17am UTC](https://forum.inductiveautomation.com/t/security-level-parent-child/110563/1 "2025-09-12T07:17:39Z")

</div>

![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/e/5eeb32fab5ed07908b78cf94b9fa039f50aa2feb.png)  
I added the API Level and 3 Childs.

For the API-Key I set the API Security Level.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/3/c348cc5bc2b99e1c54e570312ff1e4685a0a22f9.png)

For Gateway Write Permission I set Write Security Zone.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/5/d5e328f50b50824fa9b65c6b52ab18dc4e21e401.png)

So now the Problem is, that I always get a Unauthorize Error Message, if I want to call a POST command. Only if I check the single Security Levels (Access,Write,Read) on the API-Key it will work.

Is this a Bug or should it work like this?

I hope it is understandable.

Thanks.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [September 12, 2025, 3:37pm UTC](https://forum.inductiveautomation.com/t/security-level-parent-child/110563/2 "2025-09-12T15:37:00Z")

</div>

> [@marco.handle](#):
>
> Is this a Bug or should it work like this?

This is intended behavior.

Security level inheritance works the opposite of what you're describing.

That is,  
If your API key is configured with `API/Write`, then you _explicitly_ have `API/Write`, and _implicitly_ have `API`.

So it doesn't really make sense to have an `Access` security level.  
If you want 'Write' to imply 'Read' (and 'Read' to imply 'Access') then just make it a hierarchy:  
`API/Read/Write`. Then any key that has `Write` implicitly has the `API/Read` and `API` levels as well, and you can configure those in your permissions.