---
title: "Tag Security"
---

# Tag Security

> <IUCard title="Tag Security" link="https://inductiveuniversity.com/video/tag-security/7.9" />

## Tag Access Rights
Tag security is often the best way to configure security for data access. By defining security on a Tag, you affect the Tag across all windows in all projects, as opposed to configuring component security on each component that displays or controls that Tag.

If a user opens a window in the Client that has components that are bound to a Tag that the user doesn't have clearance to read or write to, the component will get a forbidden overlay.

![](access_denied_overlay.png)

See also: [Quality Overlays](tags/understanding-tags/tag-quality-and-overlays.md), [Permission Properties](tags/understanding-tags/tag-properties.md).

### To Set the Access Rights to a Tag
You can add read/write security to individual Tags or multiple Tags in the Designer. In order to change permissions on a Tag, you have to make changes in two places. 1) Set the **Access Rights** property to Custom. 2) Add Role(s) to the **Permissions** page.

1. In the **Tag Browser**, edit a Tag by double-clicking on the Tag.
2. In the **General** tab, from the **Access Rights** drop-down, select **Custom**.

    ![](custom-access-write.png)
 
3. Select the **Permissions** tab on the left side, and from the **Add a Role** drop-down select a role. Click the **Add** button.
4. Change each role's **Access** rights by selecting the **Read Only** or **Read/Write** option. If a user does not have any of the listed roles, they will be denied both read and write permissions.
    
    ![](access-permission.png)

5. Click **OK**. Now the user has the Read/Write permission to interact with the Tag.

## Tag Access Rights with Security Zones
Tag permissions can also include [Security Zones](security/security-zones/security-zones.md). Security Zones allow you to not only limit Tags by a user's role, but also by area. They are setup in the same way as setting the Access Rights just for a user, except a zone must also be specified. It does require that Security Zones be configured, and a few Gateways connected in a Gateway Network. Leaving the Security Zone empty will assume the access permission is for all zones.

![](multiple-roles-zones.png)