# Write Permissions Gateway Only

**URL:** <https://forum.inductiveautomation.com/t/write-permissions-gateway-only/93061>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [July 11, 2024, 7:21am UTC](https://forum.inductiveautomation.com/t/write-permissions-gateway-only/93061 "2024-07-11T07:21:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [July 11, 2024, 7:21am UTC](https://forum.inductiveautomation.com/t/write-permissions-gateway-only/93061/1 "2024-07-11T07:21:35Z")

</div>

What is the preferred mechanism to have permissions that a tag is writeable by gateway scripting only? Effectly read only by users, writeable by the gateway.

I used this technique successfully since 8.0 days:

> [@Memory tags, read only for all except gateway script](https://forum.inductiveautomation.com/t/memory-tags-read-only-for-all-except-gateway-script/69677/3):
>
> I use a security level called "Internal" and restrict the tag's write permissions to require this level. No users are granted this level, effectively restricting the tag's write permissions to gateway and tag event script.

It stopped working somewhere between 8.1.33 and 8.1.42, no idea why.

Some background:  
I use this to have separate security levels for different command destined same enumeration. E.g. Mode enum (0=Maintenance, 1=Manual, 2=Auto). Operators can put it into auto, from anywhere. Supervisors can put a device into manual, and only technicians can put a device into maintenance.

This is a achieved using booleans with the correct permissions and a tag event script on the boolean UDT member will in turn write the correct ordinal to the enumeration.

---

<div class="post-metadata">

**Author:** ![deon.korb](https://avatars.discourse-cdn.com/v4/letter/d/8c91f0/32.png) [@deon.korb](https://forum.inductiveautomation.com/u/deon.korb)\
**Post date:** [July 12, 2024, 10:35am UTC](https://forum.inductiveautomation.com/t/write-permissions-gateway-only/93061/2 "2024-07-12T10:35:13Z")

</div>

I think I found the issue, and it is somehow related to where the original action came from.

If the original write came from the designer or another tag, it works. If the original write came from Perspective, it fails.

See the attached tags and view.

Setup:

- _Security/InternalTag_ is the enumeration

- _Security/OperatorTagX_ is the boolean

- Give yourself a user grant for _Authenticated/Operator_

- Used the attached view for Perspective

From the Designer:

- Direct manipulation of _Security/InternalTag_ fails. This is expected as we don't have _Authenticated/Internal_

- Setting of _Security/OperatorTagX_ works, and triggers the change script that successfully writes to _Security/InternalTag_ and resets self

From Perspective (or Perspective preview view in the Designer):

- Direct manipulation of _Security/InternalTag_ fails. This is expected as we don't have _Authenticated/Internal_

- Setting of _Security/OperatorTagX_ works, and triggers the change script that successfully resets self but fails to write to the secured _Security/InternalTag_

Changing the write permissions on _Security/InternalTag to Authenticated_ or _Public,_ fixes it all. This is probably insecure

[TestSecurity.json](https://forum.inductiveautomation.com/uploads/short-url/o8RJNRY7gsnTh2Jxq3yhgWCw7Bi.json) (2.7 KB)  
[TestSecurityView.zip](https://forum.inductiveautomation.com/uploads/short-url/OtO4Wp0Johc1AWTnuUrmHBvsEf.zip) (3.9 KB)