We always use the rule of least privilege, meaning that you assign the users the least amount of access to the system and reports that are necessary to complete their responsibilities. Security settings are assigned by group upon individual set up. He then repeated this question.. I responded differently to further elaborate, stating: When creating the report you can also assign security user groups for privilege to run or access these reports. In addition, you can export this data into excel or a similar platform and secure those logs with passwords or encryption keys. He seemed annoyed and moved on - BUT this is the accurate process within the system, so no winning here.