When tags are generated using the OPC-UA Client driver in Kepware they are created with Client-Access "Read/Write" as default. There should be an Option on either the device or channel in Kepware to change this default behavior to Read only.
(The workaround currently is to utilize the export/import CSV function to change the the tag property to Read Only before importing the CSV file )
The reason is that in the normal ThingWorx monitoring scenario with Kepware, e.g. monitor a temperature value: It is dangerous to forget to change this configuration to "read-only" after importing tags.
This is quite easy to miss. Missing means that values in the PLC can be changed from the ThingWorx platform (depending on configuration). This can be extremely dangerous both from a process and/or safety perspective.