Problem is that I would like to give users as little privileges as possible, and when I enable all capabilities that I managed to isolate for proper PDF reporting, users can change apps and some other stuff. Is there a way to check what are minimal capabilities necessary for some action to work (like PDF reporting)? Is there some other workaround for enabling users to add PDF reports but minimize their capabilities?
I just got back to troubleshooting this issue in my environment, and to my surprise the 500 error was no longer reproducible. I found this question and went searching to make sure that this was indeed the magic that had fixed the issue.