Weird ServiceNow Report behavior? It might be due to Lazy Loading

A weird issue was brought to me today where a pretty simple report was creating some weird behaviors. A report on work order tasks was not displaying the Asset tags on, even as admin.

We could confirm that this is a security issue by grouping by the problem field which led me to this ACL which allows read access to asset_tags if the quantity is 1 and class is not a consumable.

This ACL should be allowing us to read the asset_tag. So why is it restricting access instead?

This is due to how ServiceNow "lazy loads" data when reporting. Lazy loading doesn't bring in dot-walked records in their entirety, instead it only brings in the data requested. This is faster because there is less data.

However, ACLs are run after and since we didn't request the quantity field, the ACL restricts access to the asset tag field.

However, if you add quantity to the list of fields, the asset tag suddenly appears.

So, if you are running a report and have some weird read access restriction around dot-walked fields in a report, check your ACLs to see if any other fields are needed to get read access.

Then you can either add them to the report or deactivate the ACL.

Ideally, ServiceNow would allow admins to run a report with an "eager load" to check if lazy loading is causing the problem. Then, allow us to add additional fields in the request even if it isn't being used in the report.