SSRS – Standard Reporting - Reporting with Microsoft SQL Server 2012 - page 46

Report server administrators can customize existing roles or create new roles if the
default roles do not meet the requirements of your environment. For example, in
a SharePoint Integrated mode environment, you may have users who need to be
able to view reports and create subscriptions and alerts, but you don't want them
to be able to create new reports. This would require a custom role or permission
level because the viewer/read permission level does not allow users to create
subscriptions or data alerts and the next level up; members/contribute permission
level allows users to create reports.

Securing Report Server objects
Objects that reside on the report server, such as shared data sources, shared report
parts, and reports, are all secured like files on a Windows filesystem. Permissions
to access an object can be granted directly on the object, or it can be granted at the
folder level giving users access to all objects contained within the folder. These
permissions are, of course, granted to the user on the object or folder through
roles as we learned in the previous section.

By default, role assignments and permissions are inherited from the top-level down.
Say, for example, the Report Server folder structure resembles the diagram in the
following figure, where a folder named Reports is the top level and contains three
subfolders ( Finance , Sales , and Production ). If a user or group is given access to the
Reports folder at the top level, they will by default have access to reports contained
in all three subfolders. If, however, the user or group is only given access to the
Sales folder, they will only have access to objects in that folder and any subfolders
beneath—they will not have access to reports contained in any of the other folders
at the same level or above.

Changing the permissions at lower levels will break the chain of inheritance.
The following scenario will help to illustrate this effect:

1. Bob is granted the Publisher role on the top-level Reports folder.

2. Bob's permissions on the Finance folder are changed to Browser.

3. Bob is granted the Report Builder and Content Manager roles on the

top-level Reports folder.