# Tag permissions and gateway scripts

**URL:** <https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311>\
**Category:** Ignition\
**Tags:** ignition81, scripting\
**Created:** [July 13, 2023, 10:29am UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311 "2023-07-13T10:29:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hayden\_Watson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/hayden_watson/32/48792_2.png) [@Hayden\_Watson](https://forum.inductiveautomation.com/u/Hayden_Watson)\
**Post date:** [July 13, 2023, 10:29am UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/1 "2023-07-13T10:29:43Z")

</div>

Hey,  
If I have a tag that I want to be essentially read only, but I want my automatic gateway scripts and web Dev functions to still be able to write to it, what security zoning or settings do I need to change?

Thanks!

---

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [July 13, 2023, 11:05am UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/2 "2023-07-13T11:05:31Z")

</div>

I think, I could be wrong, you can create a user role that is never assigned to any user, and set the write permissions to require that role. Scripting should I think still be able to write to it. I'm actually not entirely sure how it works for gateway scoped writes...

---

<div class="post-metadata">

**Author:** ![Hayden\_Watson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/hayden_watson/32/48792_2.png) [@Hayden\_Watson](https://forum.inductiveautomation.com/u/Hayden_Watson)\
**Post date:** [July 13, 2023, 11:52am UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/3 "2023-07-13T11:52:34Z")

</div>

I was wondering if a security zone including only my gateway would work, as I worry that if I use a role, and there's no currently open session, would the role still work? Or does the gateway have its own 'session'?

---

<div class="post-metadata">

**Author:** ![nminchin](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nminchin/32/6911_2.png) [@nminchin](https://forum.inductiveautomation.com/u/nminchin)\
**Post date:** [July 13, 2023, 12:09pm UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/4 "2023-07-13T12:09:28Z")

</div>

I have a feeling that the tag security doesn't care if its run under the gateway scope - permissions rules are essentially voided in that case and the gateway can do what it likes

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [July 13, 2023, 3:15pm UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/5 "2023-07-13T15:15:41Z")

</div>

Tag writes on the gateway originating anywhere that isn't Perspective will automatically have the "system" context:

> A SecurityContext without any security level, roles or zones set, but the isSystem flag is set to true. This indicates to the tag system that a tag write is originating from the gateway, and there is no relevant user info. Examples include gateway tag event scripts and tag writes from SFCs.

From Perspective, writes will originate as the appropriate user.  
And the 'system' context, if I remember right, is basically allowed to write to whatever.

---

<div class="post-metadata">

**Author:** ![Hayden\_Watson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/hayden_watson/32/48792_2.png) [@Hayden\_Watson](https://forum.inductiveautomation.com/u/Hayden_Watson)\
**Post date:** [July 14, 2023, 5:52am UTC](https://forum.inductiveautomation.com/t/tag-permissions-and-gateway-scripts/76311/6 "2023-07-14T05:52:28Z")

</div>

Okay great, I'll set a special system user role for these tag writes

Thanks!