A scheduled report can email rows the recipient cannot open in the app

Scheduled reports are often built once by a worker that has broad read access, then the same PDF or CSV goes to everyone on the subscriber list. The worker never asks what each recipient is allowed to see.

Finance gets the full pipeline report every Monday. Two people on that list lost access to a closed deal last week. They still get that deal's numbers in the attachment, because the job ran as a service account and reused one file for the whole list.

Generate the report per recipient, with that person's read filter applied to the query (or filter a shared result set before you render their copy). If you keep one shared artifact for caching, strip or omit rows each recipient cannot read before you attach or link it.

Quick test: subscribe user B to a report that includes a record only user A can open. After the job runs, open B's email. If that record appears in B's attachment, the job skipped the per-recipient check.