Report\_view access control

concept australia Updated Sep 10, 2026 4 min read report-view-access-control.md
Raw file servicenow.com

The report_view operation is a record type ACL that restricts access to data visualizations and Core UI reports. Only users who have one of the required roles can view visualizations that contain the restricted resource.

To create a report_view ACL, follow the general procedure for creating an ACL rule. Create an ACL rule with the following settings:

  • Type: record
  • Operation: report_view
  • First table field: Required. Enter the name of the table on which to apply the ACL rule.
  • Second (unlabeled) table field: If you want the ACL rule to apply to a specific field on the table, select the field name here. Select a wildcard (*) to give access to all fields on the table. Leave this field empty to create a row-level ACL rule, which gives access to the table records.
  • Conditions: Specify at least one role OR at least one security attribute condition. Data conditions and advanced conditions are not supported.

Set the other options freely.

Table vs field report_view rules

Record-type ACL rules can apply to either a table or a field (or all fields) on a table. For report_view operations, a table rule allows only users with the specified roles to see the contents of visualizations of that table. A field rule allows only users with the specified roles to see visualization contents that show the field. A field rule also restricts all content of a visualization that has that field in its data source conditions. Field report_view rules also apply to reference (dot-walked) fields.

For example, a report_view field ACL requires that users have the chat_admin role to view the Assignment Group field in visualizations of the Chat Queue table. This table is readable to all internal users. Two single-score visualizations are created that show the count of records on Chat Queue. One visualization has no conditions, and the other has Assignment Group = Database. Both visualizations are shared with a user who doesn't have the chat_admin role. This user can see the metric in the visualization without conditions. However, when they open the visualization with the condition on the Assignment Group field, they see that their access is restricted by the report_view ACL.

Report_view operation design considerations

Use these guidelines when creating your own report_view operation access controls.

  • Restrict access to visualizations by a required role

    The report_view operation usually has an Allow If decision type, granting view access to visualizations to users with specified roles.

  • Require conditions to be met to view a visualization

    Instead of requiring user roles, a report_view operation can require conditions to be met. These conditions are defined by security attributes. Often these are basic conditions that must be met, so the report_view rule has the Deny Unless decision type.

  • Restrict access to list visualizations with a read operation

    List data visualizations and Core UI list reports do not follow report_view ACLs. Instead, they use record access controls that determine who can access data in a table or field. To restrict access to record data in lists, create a read operation access control. For more information about record access controls, see Access control list rules.

Report_view field ACL rule with roles

You need to grant access to visualizations of all fields on the Performance Analytics cached forecast table to users with the pa_admin role. Therefore you create an ACL rule. The rule affects visualization access, so you create a rule where type=record and operation=report_view. You specify the Cached forecast [cached_forecast] table. For the field, you specify the wildcard (*). Doing so means that the rule grants viewing rights to visualizations of all fields on cached_forecast to users with the specified roles. Finally, you specify the pa_admin role.

[Omitted image "report-view-acl-rule.png"] Alt text: Report_view rule with a wildcard in the Field field, giving access to all fields on the specified table to the selected roles.

Report_view table ACL rule with security access condition

You want only logged-in users with roles to be able to see visualizations of the Incident [incident] table. You can't set these conditions with role requirements, but fortunately there is an existing compound security attribute called UserIsAuthenticated for this situation. Therefore, you create a report_view table ACL on Incident that uses this security attribute condition. You also set the decision type to Deny Unless. Doing so prohibits any user not logged in with a role from viewing visualizations of the Incident table, regardless of any other report_view ACL rules they satisfy.

[Omitted image "report-view-sec-access-con.png"] Alt text: Report_view rule with a security attribute condition instead of a required role.

  • Fallback ACL evaluation
    When a data visualization is run, report_view access control lists (ACLs) are evaluated on the table and table fields that the report is based on. If no report_view ACL exists, there is a fallback check on table-level read ACL roles.

Parent Topic:Configure data visualizations

Related topics

Configure an ACL

Security Attributes

Search documentation
Search document titles and file paths on the australia branch