{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":36236,"path":"now-intelligence/reporting/read-access-control.md","title":"Report execution security","bundle":null,"doc_type":null,"release":"australia","body":"\n# Report execution security\n\nWhen a report is run, report\\_view access control lists \\(ACLs\\) are evaluated on the table and table fields that the report is based on. If no report\\_view ACL exists, there is a fallback check on table-level read ACL roles. The report\\_view ACL checks on all fields, including those used in the condition builder \\(including dot-walked fields\\).\n\nThe fallback read ACL is controlled by the system property **glide.report.report\\_view.read\\_acl**.\n\nThis property has three possible values. The default value is `enforce`.\n\n-   **ignore**\n\n    No evaluation is conducted against the read ACL and all users can see the report.\n\n-   **enforce**\n\n    If no report\\_view ACL for that table or table field exists, evaluation is conducted against the read ACL. Users can only view the report if they pass the read ACL.\n\n-   **log**\n\n    The read ACL check isn’t enforced if there is no report\\_view ACL for that table or table field, but the administrator can see in the logs which users would have been blocked if the security check was enforced.\n\n\nIt isn’t recommended to change the system property to ignore or log as the read ACL fallback provides an extra level of protection when viewing a report.\n\n**Note:** The fallback table-level read ACL check applies only to roles, not to scripts or conditions. If a table-level read ACL has roles and scripts or roles and conditions, or roles, scripts, and conditions, only the roles are evaluated.\n\n\\[Omitted image \"read-acl-evaluation.png\"\\] Alt text:\n\n**Parent Topic:**[Report\\_view access control](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/now-intelligence/reporting/report-view-access-control.md)\n\n"}}