Prevent custom roles from allowing users to delete reports they do not own

What is the challenge?

• Any user assigned a custom account role is treated as a full administrator for report management purposes.

• This means a user given a custom role to access a specific settings page can also delete any saved report in the account, including reports they did not create.

What is the impact?

• Using custom roles to grant scoped settings access can unknowingly exposing all saved reports to deletion by those users.

Describe your idea.

• Tighten the permissions check for report deletion so that holding a custom role alone does not confer admin-level report management access.

• Only users with an actual administrator role (account, billing, or customization) should be able to delete reports they did not create or access the All reports overview filter. Custom role holders who are not also assigned a standard admin role should only be able to delete their own reports.