Report or dashboard widget denied for all users – sys_report "roles" field contains the text "null"

[Community Alums]

Problem

A report on our dashboard was blocked for users who clearly had the right roles and table access. Admins could see it. The report_view ACLs and table read ACLs all looked correct.

Root cause

The report record (sys_report) had its Roles field set to the literal text null. This is a string, not an empty value. The platform treats it as a role called "null". Nobody has that role, so everyone except admin is denied.

This can happen when reports are created or copied by script, or imported, and an empty value gets written as the string "null".

How to find affected reports

1. Open sys_report.list.
2. Don't use the filter Roles is empty, because it won't find these reports. Use Roles = null (the text) or run a script.
3. Check the reports used on the dashboard first.

Solution

1. Set the Roles field to a real role (e.g. itil). Or clear it if the report should follow normal sharing.
2. If many reports are affected, fix them in bulk with a background script inside an update set.
3. Re-test by impersonating a normal user.

Script outline

// query sys_report where roles == 'null' (string)
// for each: print title + table (dry run first)
// set roles = '<required role>' or ''
// setWorkflow(false); update()
// print total fixed

Tips

• Always do a dry run (print only) before the update.
• Check the report's sharing settings after the fix.
• If users still see "denied based on report_view ACLs", check the ACLs next. But check this field first, because it takes one minute.

Hope this saves someone time. Happy to share the full script if needed.