Platform Analytics: Indicators access in Australia version for ITIL Role

RaniK3666699030 · 3 weeks ago

In Australia version of ServiceNow (patch 2) , for a user with ITIL role, per the documentation the user should be able to view the indicators. However as that user when I look at the indicators I see the word "None" in the "Name" column. And when I click on the word "None", it does open the Indicator and shows the record. I granted pa_viewer, report_user roles and yet indicators name does not show correctly. Any one has any suggestions? Do not want to grant higher level access roles unless it is really needed. Appreciate input. Thanks!

Vikram Reddy · 3 weeks ago

Hello @RaniK3666699030,

Open one of the indicators showing "None":
  pa_indicators record > Access Control section
    Checkbox: Visible by all roles
    Related list: Roles

pa_viewer and report_user only get the user into the Platform Analytics workspace itself, they don't grant visibility into individual indicators. That's a separate layer: each pa_indicators record has its own Visible by all roles checkbox and Roles related list, and if it's unchecked with itil/pa_viewer missing from that list, the workspace list blanks the name (hence "None") while the base record ACL still lets the user open it directly, which is exactly the split behavior in your screenshot.

If you've got a handful of these, add the role to the Roles related list on each; if it's most of the 438, it's faster to bulk-set "Visible by all roles" from the list view. Happy to dig deeper if you can share whether these are formula, manual, or automated indicators. Try this and let me know

References

Thank you,
Vikram Karety
Octigo Solutions INC

RaniK3666699030 · 3 weeks ago

Thank you Vikram for your input. Looked at the "Visible to" and "Visible by all roles" values for some of these indicators and there is no pattern. Some are formula indicators, some are automated indicators. Some has both Visible to and Visible by all roles as Everyone and True respectively. And yet a user with ITIL and pa_viewer cannot see the Name and other details under the Indicator tab in Platform Analytics.

% of incidents resolved by first assigned group

Average age of last update of open incidents
Number of incidents with active sla

Issues resolved

Number of Incidents with Problem associated

Incidents – average time to resolve

IT: Time to resolve

Vikram Reddy · 3 weeks ago

Hi @RaniK3666699030,

Good, that rules out a lot. If it were a per-indicator config problem you'd expect it to track with Visible to/Visible by all roles or with source type, and it clearly doesn't. That points away from indicator-level access control entirely and toward one of two things: a field-level restriction on the Name column itself, or a rendering bug in the Indicators list widget in the Platform Analytics Workspace.

On the first one: row-level access (the Roles related list, Visible by all roles) and field-level access are two separate ACL layers in ServiceNow. The row-level check is what's already working correctly for you, that's why the record still opens and shows the right name when you click through. But there can also be a field ACL scoped to just pa_indicators.name (table.field, not table-level), and that one gets evaluated independently by the list/grid renderer. If that field ACL requires a role above pa_viewer, the row passes but that single column blanks out, which matches what you're describing almost exactly. Worth checking directly:

Go to System Security > Access Control (sys_security_acl.list) and filter Table equals pa_indicators
Look specifically for a row where the Name/target is pa_indicators.name (not just the table-level read row), and check which role(s) it requires
If it's scoped above pa_viewer, that's a config or defect issue you can act on directly rather than guessing

Second angle, since a Now Experience/UI Builder screen (which the Indicators list in Workspace is) can pull the grid data through a different data broker than the one used to render the individual record, it's entirely possible the list's name lookup is failing silently for non-admin sessions while the detail screen resolves it through a separate call that isn't hitting the same restriction. That's a rendering inconsistency, not a permissions gap, and it wouldn't show any pattern by source type or visibility flag, which is exactly what you're seeing.

One more empirical test, since you've varied the indicator config but not the user's own role tier: temporarily put pa_power_user on a throwaway test account (not production) and see if Name renders correctly for that user. pa_power_user sits above pa_viewer in the Platform Analytics role hierarchy and governs things like widget/content authoring, so it shouldn't matter for pure viewing, but if it fixes the display, that tells you there's an undocumented dependency you haven't hit yet rather than a rendering bug.

Given you've already eliminated the obvious config variables and this is a brand-new release (Australia patch 2), I'd treat this as a candidate defect at this point rather than keep chasing role combinations. Log it with Now Support with that exact indicator list you posted as repro data, since a clean, config-independent reproduction like that is exactly what gets a defect triaged fast instead of bounced back as "check your roles."

References

Why isn't the visible_to "everyone" field honored on an indicator

Thank you,
Vikram Karety
Octigo Solutions INC