Permission
The user must first have the relevant read, write or control permission at an effective scope.
PlcConsoleRemote Manual · Guardrails
Command policies
Constrain register access by operation, Fatek register family and optional address range after permission has allowed the request.
Two Boundaries
Permission decides what may be attempted, policy narrows where
PLC policy
The policy linked to that PLC can further restrict register operations, families and ranges.
Backend validation
The server validates the family’s minimum, maximum and address step before execution.
No assigned policy is unrestricted by policy. An assigned policy with no rules denies all register access. A policy never expands a user’s permissions.
Policy Catalog
Keep reusable device guardrails explicit
Folded policy catalog
- Review the policy name and summarized family or range count.
- Filter before changing or archiving a policy.
- Use a full-access policy only when unrestricted register access is intentional.
- Assign the policy from the PLC record that it protects.
Expanded partial-access policy
Expansion keeps family-operation rules and optional ranges next to the policy that owns them. Read the operation and family together, then verify every inclusive range against the target PLC program.
Evaluation
Apply the policy only after permission has allowed the operation
| PLC policy state | Register result | Non-register operations |
|---|---|---|
| No policy assigned | The policy gate is unrestricted; permission and protocol validation still apply. | Controlled by their corresponding operation permissions. |
| Policy with matching rule and no ranges | All valid addresses for that family and operation pass the policy gate. | Unaffected by register rules. |
| Policy with matching ranged rule | Every requested address must fall inside an allowed inclusive range. | Unaffected by register ranges. |
| Assigned policy with no rules | All register operations are denied intentionally. | Test, status, run and stop remain permission-controlled. |
| Assigned policy unavailable | The request fails closed rather than silently becoming unrestricted. | Investigate the catalog relationship before operating the PLC. |
Both gates must pass:
device.register.read, device.register.write or device.register.control must be granted at an applicable scope and the assigned PLC policy must cover the complete register request.Procedure
Create a policy from the PLC program's intended boundary
Before you begin
- Identify the target PLC and the users or roles that will operate it.
- List required Fatek register families separately for read, write and control.
- Obtain approved inclusive address ranges from the PLC program owner.
- Decide whether unrestricted addresses within a family-operation pair are genuinely intended.
Expected result
The policy appears in the active catalog, its expanded row shows the expected family-operation rules and ranges and the target PLC references it by name.
Steps
- Choose Create policy and enter a clear name describing the boundary.
- Add one rule for each required family and operation combination.
- Add one or more ranges when only part of that family is allowed. Leave ranges empty only when all valid addresses are intended.
- Resolve frontend range feedback, then submit. The backend repeats authoritative family, minimum, maximum and address-step validation.
- Expand the policy and compare every saved rule with the approved design.
- Edit the target PLC and assign the policy.
- Test one allowed request and one request outside the allowed range, then confirm the corresponding success and denial evidence.
Examples
Make intent visible in the rule design
Read-only telemetry
Grant register-read permission and create READ rules only for the families and ranges used by the monitoring view. Do not add WRITE or CONTROL rules.
Bounded set-point write
Add WRITE for the exact family and address range containing approved set points. Keep control coils or unrelated data registers outside the rule.
Discrete control
Use the control permission and CONTROL policy operation for the intended discrete family and addresses. Do not treat it as ordinary numeric write access.
Deny all register access
Assign a policy with zero register rules when status, test, run or stop may remain available but all register reads and mutations must be blocked.
Troubleshooting
Find whether permission, family, operation or range caused the denial
Allowed in role, still denied
Open the PLC's assigned policy and compare family, operation and every address in the request. Permission alone does not bypass policy.
Range cannot be saved
Check the selected family's supported minimum, maximum and address step. Double-word families may require aligned addresses and consume more than one word.
Policy appears broader than intended
A rule with no ranges allows all valid addresses for that family and operation. Add explicit ranges or remove the rule.
Archive warning names PLC impact
Reassign dependent PLCs first. An unavailable assigned policy fails closed and may interrupt intended register operations.