AI Report Permissions

Access to AI reports works in two layers:

Permission sets decide who can use the feature at all. Both AFR_Hgd and AFR_READONLY_Hgd include it (see Setup).
Permission lists decide who may use a particular instruction and who may open a particular report. Every instruction has one, and every generated report has its own.

On top of that, the agent reads Business Central data with the Business Central permissions of the user who runs it.

Access Levels

Level	On an instruction	On a report
Owner	Edit the instruction (prompt, formulas, Reports to Keep); have the designer rewrite it; manage its permission list; delete it, with all its reports; and everything Read Only can do.	Manage the report's permission list; delete the report; and everything Read Only can do.
Read Only	See the instruction (the card opens read-only); generate reports from it; schedule it; design reports in the designer and save them.	Open the report, download and print it, read its generation log.
(no access)	The instruction is not listed and cannot be opened or run.	The report is not listed and cannot be opened.

An instruction or report with no permission rows is unrestricted: everybody has Owner access to it.

The Permission List

Open it with Permissions on the instruction list or card (the instruction's list), or on the AI Reports list or viewer (that report's list). Only owners can open it. It shows exactly one list: the instruction's rows and a report's rows are separate.

Field	Meaning
Type	User (one user), Security Group (every member of the group) or Everyone.
User / Group Name	The user name or security group code. The lookup offers users or groups according to the type. Leave it blank for Everyone.
Full Name	The user's full name (blank for groups and Everyone).
Access	Owner or Read Only. New rows default to Read Only.

How a user's access is decided

A row for the user personally wins, whatever groups the user belongs to.
Otherwise, the most permissive row among the security groups the user is a member of.
Otherwise, the Everyone row.
Otherwise, no access, unless the list is empty, which means unrestricted.

Rules that keep a list workable

A new instruction belongs to its creator. An Owner row for the creator is added when the instruction is created.
Opening Permissions on an unrestricted instruction or report first adds you as its Owner.
The first row must make someone an owner. You cannot start a list by adding only yourself as Read Only.
The last owner cannot be removed or downgraded while other rows exist (This is the last owner of …). Add another owner first. Deleting every row makes the object unrestricted again.
Names are checked. A User row needs an existing user, a Security Group row an existing group, and an Everyone row no name.

Instruction List and Report List

When a report is generated, the instruction's permission list is copied onto the report as the report's own list. This applies to manual, background and scheduled runs, and to reports saved from the designer.

From then on the two lists are independent:

Changing the instruction's list affects only reports generated afterwards. Existing reports keep the audience they were created for.
A report's owners can change the report's list (Permissions on the AI Reports list or in the viewer) without touching the instruction.

Because the report's list starts as a copy, an instruction's owners are normally owners of its reports too, and its readers can open them.

The board should see this quarter's report, but must not run the instruction or see other quarters:

Open AI Reports, select the report, choose Permissions.
Add a row: Type Security Group, the board's group, Access Read Only.
Close the page.

Board members can now open that one report. The instruction and its other reports are unchanged.

Restricting an instruction to a team

Payroll analysis should be run and read only by the finance managers:

On the instruction, choose Permissions. You are listed as Owner.
Add Type Security Group, the finance managers' group, Access Read Only. Add a second Owner if someone should be able to maintain the instruction when you are away.
Every report generated from now on can be opened only by the listed users. Reports that already exist keep their own lists, so adjust those too if needed.

Deleting

Object	Who may delete
Instruction	An owner of the instruction, or a SUPER user. Deletes all its reports, permission lists and job queue entries.
Report	The user who generated it (even with Read Only access to the instruction), an owner on the report's list, or a SUPER user.

Reports to Keep pruning deletes old reports automatically, regardless of these rules.

SUPER Users

SUPER users get no implicit access to content. A restricted instruction or report that does not list them cannot be opened, run or viewed by them. For administrative recovery they:

see every instruction and report in the lists,
may delete any instruction or report,
may manage the permission list of an instruction or report that has no live owner left: all its Owner rows name users who are disabled or deleted. Owner rows for a security group or Everyone count as live.

Scheduled Runs and Data Access

A scheduled run executes as the job queue entry's user. That user needs at least Read Only access to the instruction, or the job fails (see Who runs a scheduled report).
The agent sees only what the running user may read in Business Central: tables, companies and saved spreadsheets (with the spreadsheet's own permission list). Give the instruction to users whose data access matches the report's audience.
The app's own spreadsheet, AI report and AI provider tables cannot be queried by the agent, whatever the user's rights. Prompts, permission lists and other reports stay out of its reach.

Error Messages

Message	Meaning
You do not have access to AI report instruction X. Access is granted by its owner: …	You are not on the instruction's list. Ask a named owner.
You do not have access to AI report N. Access is granted by the owner of its instruction: …	You are not on the report's list.
Only an owner of AI report instruction X can change it or manage its permissions.	Read Only users cannot edit the instruction or its list.
Only an owner of AI report N can manage its permissions.	Only owners on the report's own list can change it.
Only an owner or the user who generated it can delete AI report N.	See Deleting.
Only an owner of AI report instruction X can delete it.	See Deleting.
This is the last owner of …	Add another owner before removing or downgrading this one.
The first permission row must make someone the owner.	Add yourself as Owner first.
An Everyone row applies to all users — leave the name blank.	Clear the name on an Everyone row.
Security group X does not exist.	Check the group code.
A permission row cannot be moved to another report.	Create a new row on the other report's list instead.