Introduction
Introduced in FME 2026.2 as part of ongoing security improvements across the FME platform, security tiers give administrators greater control over what functionality can be executed in their environment. This applies whether you're managing an organization-wide FME deployment or have local admin rights on your own machine. If you've seen a log message about security tiers, or are configuring this setting for the first time, this article explains what security tiers are, how to choose one that matches your risk tolerance, and what to expect when you make a change.
Log Message
Error: …This workspace may require a capability not permitted by your current security settings. See https://fme.ly/ybu for more information
Or…failed to evaluate expression
This message appears when a workspace attempts to use functionality that is restricted under your environment's current security tier. If you are an administrator, review your current security tier selection and consider whether an adjustment or a custom override is appropriate. If you are a user, contact your administrator to determine whether the required capability can be enabled in your environment.
Security Tiers
Security tiers can only be changed by administrators.
- Default Hardening: Default tier for new installations. Balanced security level allowing most operations.
- Minimal Hardening: Should only be used in isolated or testing environments. Basic security level allowing almost all capabilities.
The restrictions amongst the tiers are subject to change between releases. As best practice, always use the Default Hardening level whenever possible.
Advanced - Custom Security Override
A JSON snippet can be used to fine-tune the selected tier. Please contact Support for a snippet.
Changing the Tier
Security tiers can only be changed by an administrator and should be changed only on an as-needed basis. The Default Hardened tier is sufficient for almost all FME use cases.
FME Form
To change the tier in FME Form, open FME Workbench as an Administrator. Navigate to Utilities > FME Options > Security, then select the desired tier. After clicking Apply, close all FME Form applications and reopen them.
To open FME Workbench as admin on macOS/Linux:
macOS:sudo "/Library/FME/2026.2/Apps/FME Workbench 2026.2.app/Contents/MacOS/FME Workbench 2026.2"
Linux:
sudo /opt/fme-form-2026.2/fmeworkbench
Note that FME is licensed per user, so an admin session of FME will require FME to be relicensed.
FME Form CLI
To allow FME Admins to better automate/deploy the Security Hardening configuration for their machines, it is possible to set the tier from the command line:
fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "recommended"
Or
fme APPLY_SETTINGS SYSTEM Hardening/HardeningPolicyTier "minimal"
FME Flow
To change the tier in FME Flow, log in as an Administrator. Navigate to System Configurations > Security, expand Security Hardening, and select the desired tier. When changing to a lower security tier, a warning dialog will appear. After clicking Confirm in the warning dialog, click Save in the Security Hardening parameters to complete the change.
Changing the security tier will trigger an asynchronous restart of all engines. Each engine restarts only after completing any current jobs, then re-registers with FME Flow so the updated security policy can be applied during the registration handshake. Because the restart is asynchronous, confirmation that the tier has changed will be provided before all engines have successfully restarted and received the update.
Support
If you have any questions or need to request a JSON snippet, please contact Support.