# Security Zones, Levels, Roles, and Perspective View Permissions

**URL:** <https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605>\
**Category:** Ignition\
**Tags:** ignition81, perspective\
**Created:** [June 20, 2025, 5:23am UTC](https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605 "2025-06-20T05:23:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Douglas\_Lawrie](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@Douglas\_Lawrie](https://forum.inductiveautomation.com/u/Douglas_Lawrie)\
**Post date:** [June 20, 2025, 5:23am UTC](https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605/1 "2025-06-20T05:23:05Z")

</div>

My end goal is to restrict View Permissions to certain IdP roles in certain Security Zones. I have created custom Security Levels to match up with IdP roles. The intuitive way to do that is configuring these View Permissions:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/a/9a92be09a7f622b26d06e7038a9d59e05907f420.png)

I think my problem is that although these role-based Security Levels do seem to be granted to users on login:

- Authenticated/Roles/Administrator
- Authenticated/Roles/Operator

the zone-specific levels (e.g., Authenticated/Roles/Administrator/Zone 1) are not automatically granted. I have read these articles in the user manual:

- [Security Levels | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/security-levels)
- [Security Level Rules | Ignition User Manual](https://docs.inductiveautomation.com/docs/8.1/platform/security/identity-provider-authentication-strategy/security-level-rules)

It seems I cannot create custom Security Level Rules for the zone-specific levels under each role either:

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/c/3ccc671f57ad30150d3c9f37da5714c1e07d3f3d.png)

**How do I get these security levels granted when a user satisfies both the role and zone conditions? Is there a better way to do this?**

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [June 20, 2025, 6:18am UTC](https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605/2 "2025-06-20T06:18:39Z")

</div>

In your posted first image, check "The security levels... must match all of the required security levels".

---

<div class="post-metadata">

**Author:** ![Douglas\_Lawrie](https://avatars.discourse-cdn.com/v4/letter/d/a87d85/32.png) [@Douglas\_Lawrie](https://forum.inductiveautomation.com/u/Douglas_Lawrie)\
**Post date:** [June 20, 2025, 6:53am UTC](https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605/4 "2025-06-20T06:53:32Z")

</div>

My security zones are mutually exclusive, so it is not possible to be client in more than one. That is why I have the 'any' option selected.

---

<div class="post-metadata">

**Author:** ![diamond](https://avatars.discourse-cdn.com/v4/letter/d/e79b87/32.png) [@diamond](https://forum.inductiveautomation.com/u/diamond)\
**Post date:** [June 20, 2025, 7:22am UTC](https://forum.inductiveautomation.com/t/security-zones-levels-roles-and-perspective-view-permissions/107605/5 "2025-06-20T07:22:33Z")

</div>

You'll need to create some levels that represent you "zone groups", I guess.