3758132 - Report Data Not Restricted by Role When Report is Shared via Role

Users observe that when a report is shared with a specific RBP role, the report output still displays data beyond that role's population.

• Sharing a report with roles only controls access to the report.
• It does not control or restrict the data returned when the report is executed.

This is an intended behaviour of the system  .

When a report is shared with a specific role, the report is shared to all users assigned to that role. However, this sharing mechanism does not imply that the executed report data will be restricted to the target population and permission associated with that role.

At runtime, when a user executes the report, the system evaluates the user’s complete set of RBP permissions, including all assigned roles and the corresponding target populations. The report output is generated based on these combined permissions.

It is important to note that:

• Report sharing by role is intended solely to provide access to the report.
• It does not control or limit the data scope of the report.
• It is not possible to include or exclude data dynamically based only on the role used for sharing.

Therefore, the data displayed in the report reflects the full authorization context of the executing user, rather than being restricted to a specific RBP role used during report sharing.