# Security permissions requiring logical combinations or roles and zones

**URL:** <https://forum.inductiveautomation.com/t/security-permissions-requiring-logical-combinations-or-roles-and-zones/78877>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [September 7, 2023, 8:33pm UTC](https://forum.inductiveautomation.com/t/security-permissions-requiring-logical-combinations-or-roles-and-zones/78877 "2023-09-07T20:33:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![justin.brzozoski](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justin.brzozoski/32/13452_2.png) [@justin.brzozoski](https://forum.inductiveautomation.com/u/justin.brzozoski)\
**Post date:** [September 7, 2023, 8:33pm UTC](https://forum.inductiveautomation.com/t/security-permissions-requiring-logical-combinations-or-roles-and-zones/78877/1 "2023-09-07T20:33:48Z")

</div>

I'm trying to lock down access to the designer and gateway pages based on a combination of roles and security zones. For simplicity, let's just say the role is `Administrator` and the two security zones are `trusted_ips` and `localhost`.

Most of the config on the two security zones is similar, but `localhost` is my last-ditch fallback that allows un-secured connections while `trusted_ips` requires secured connections, so I can't combine them into one zone without giving up some of those restrictions.

Once I switch the designer authentication to identity provider, I can set the permissions fields to a combination of roles and security zones, but I can't make something like:

```auto
Authenticated/Roles/Administrator AND (SecurityZones/localhost OR SecurityZones/trusted_ips)

```

I know I could get almost what I want by making one security zone covering both IP sets and dropping the secure connection requirement, but is there a better way to get everything I want?

I vaguely remember in the past I've seen mention of a "combined" role/zone security level concept, but I can't seem to find that now. Is there some way to make a `Administrator/trusted_ips` level and a `Administrator/localhost` level and I could both of those in the permissions with a simple OR config?

---

<div class="post-metadata">

**Author:** ![Hayden\_Watson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/hayden_watson/32/48792_2.png) [@Hayden\_Watson](https://forum.inductiveautomation.com/u/Hayden_Watson)\
**Post date:** [September 8, 2023, 6:09am UTC](https://forum.inductiveautomation.com/t/security-permissions-requiring-logical-combinations-or-roles-and-zones/78877/2 "2023-09-08T06:09:53Z")

</div>

When you add a security zone it should append these as options to the end of your normal levels, i.e.  
`Authenticated/Roles/Maintenance/SecurityZones/Remote Maintenance User`

So for your designer permissions you could add:  
`Authenticated/Roles/Administrator/SecurityZones/localhost, Authenticated/Roles/Administrator/SecurityZones/trusted_ips`