Report_view access control
The report_view operation is a record type access control list (ACL) that restricts access to reports. Only users who have one of the required roles can view reports that contain the restricted resource.
To create a report_view ACL, follow the general procedure for creating an ACL rule, but bearing the following points in mind:
There are two kinds of report_view access control lists (ACLs): report_view table ACLs and report_view field ACLs. Report_view table ACLs prevent users from viewing report or data visualization content based on the table specified in the ACL. Report_view field ACLs prevent users from viewing reports or data visualizations that use the field specified in the ACL in the group by, row, column or aggregation settings.
For example, a report_view field ACL grants the report_admin role viewing access to the salary field in an HR table. When users with the itil or report_user role access a report grouped on the salary field, they see: Access to this content denied based on report_view field ACLs.
Report_view operation design considerations
Use these guidelines when creating your own report_view operation access controls.
Restrict access to reports by a required role
The report_view operation only supports access restrictions based on a required role. A report_view access control does not support scripts or advanced conditions.
Restrict access to list reports with a read operation
A list report uses regular record access controls to determine who can access data in a table or field. A report_view access control cannot prevent users from viewing lists to which they have read access. To restrict access to record data in lists and forms, create a read operation access control. For more information about record access controls, see Access control list rules.
Report execution security
When a report is run, report_view access control lists (ACLs) are evaluated on the table and table fields that the report is based on. If no report_view ACL exists, there is a fallback check on table-level read ACL roles. The report_view ACL checks on all fields, including those used in the condition builder (including dot-walked fields).
Parent Topic:Administering reports
Related topics