Ohai!

[root@centos7-foreman-nightly ~]# hammer role create --name loltest
User role [loltest] created.

[root@centos7-foreman-nightly ~]# hammer filter create --role loltest --permissions view_organizations
Could not create the permission filter:
  Location ids You can't assign locations to this resource

[root@centos7-foreman-nightly ~]# hammer filter create --role loltest --permissions view_locations
Could not create the permission filter:
  Organization ids You can't assign organizations to this resource

Although hammer does not send any org/loc in the request:

[ INFO 2019-11-15T10:27:51 API] POST /api/filters
[DEBUG 2019-11-15T10:27:51 API] Params: {
    "filter" => {
               "role_id" => 12,
        "permission_ids" => [
            [0] 79
        ]
    }
}

The UI does not expose the same bug.

This can be workarounded by passing --override true --locations "" --organizations "" to the hammer call.

Explicitly passing organization_ids: [] in the API request also helps:

[root@centos7-foreman-nightly ~]# curl -k -H "Content-Type: application/json" -u admin:changeme -d'{"filter":{"role_id":12,"permission_ids":[79]}}' https://localhost/api/v2/filters
{
  "error": {"id":null,"errors":{"organization_ids":["You can't assign organizations to this resource"]},"full_messages":["Organization ids You can't assign organizations to this resource"]}
}

[root@centos7-foreman-nightly ~]# curl -k -H "Content-Type: application/json" -u admin:changeme -d'{"filter":{"role_id":12,"permission_ids":[79],"organization_ids":[]}}' https://localhost/api/v2/filters
{"search":null,"resource_type":"Location","resource_type_label":"Location","unlimited?":false,"created_at":"2019-11-15 10:31:32 UTC","updated_at":"2019-11-15 10:31:32 UTC","override?":false,"id":171,"role":{"name":"loltest","id":12,"description":null,"origin":null},"permissions":[{"name":"view_locations","id":79,"resource_type":"Location"}],"locations":[{"id":2,"name":"Default Location","title":"Default Location","description":null}],"organizations":[]}

The same issue should apply for all Org/Location permissions, but only those (well, any taxonomy, really, but we only have these two).