Each report is granted to a list of users. A user only sees and runs the reports granted to them, and the server checks the right before each run.
