A radio access network, RAN, node configures user plane access stratum, AS, security in a wireless communication system that includes a radio access network, RAN, and a core network, CN. The RAN node is configured to receive, from the CN, signaling that indicates a decision by the CN of whether or not the RAN node is to activate user plane AS security and that indicates whether or not the RAN node is allowed to overrule the decision by the CN. For example, the signaling may indicate whether the decision by the CN is a command that the RAN node must comply with or a preference that the RAN node is permitted to overrule. Regardless, the RAN node may also be configured to activate or not activate user plane AS security, depending on the signaling.