Report and dashboard access is controlled by folders, not by records. A folder is shared with users, roles or groups at one of three access levels, and that decides who can open, edit or manage what is inside. Folder access and record access are separate systems that both apply, which is why someone can open a report and see none of the rows in it.
The three access levels
Viewer. Can open reports in the folder and run them. Cannot save changes to the folder’s reports, though they can run a report and save a copy elsewhere if they have the permission to create reports.
Editor. Can view, and can change and save the reports in the folder. Cannot change who the folder is shared with.
Manager. Everything an editor can do, plus sharing the folder, renaming it and deleting it. Give this out sparingly. A manager on a folder can share it with the whole organisation.
Folders can be shared with individual users, roles, roles and subordinates, roles and internal subordinates, public groups, territories, and in some configurations portal or community groups. Sharing with a role and its subordinates is the usual pattern and it behaves exactly as it does in record sharing: everyone at or below that role in the hierarchy.
Folder access is not record access
This is the sentence that resolves most confusion. Opening a folder gets you the report definition. Running the report gets you the rows your sharing model allows. Two people with identical folder access see different data if their record access differs, and that is correct behaviour.
The consequence people find surprising is the empty report. A user opens a report they clearly have access to, it runs, and it shows nothing. The report is fine. The folder is fine. They simply cannot see any of the records that match.
The opposite case is the dangerous one. A dashboard runs as a fixed running user, so folder access to that dashboard grants a viewer the running user’s data regardless of their own record access. Folder sharing on dashboards is therefore a data access decision, not a convenience decision.
Subfolders
Report and dashboard folders support subfolders, which helps with organisation and does nothing for security. Sharing is defined on the top-level folder and inherited downwards. You cannot share a subfolder differently from its parent.
The permissions that override folders
Several user permissions cut straight through folder sharing, and an access audit that only looks at folders will miss them.
- Manage Reports in Public Folders grants full access to every report in every public folder, whether or not the folder is shared with that user. Administrators have it. So does anyone with a profile or permission set that copied the administrator profile, which happens more often than anyone admits.
- Manage Dashboards in Public Folders does the same for dashboards.
- View All Data removes record-level restrictions, so a report that would be empty is suddenly full.
- Create and Customize Reports and the related report builder permissions decide whether someone can build anything at all, independently of folders.
When auditing who can see a sensitive report, check the folder shares and then check who holds those permissions. The second list is usually longer than the first.
Private folders and the unfiled default
Every user has a private reports area that nobody else can see, including administrators through the ordinary interface. Reports saved there are invisible to the rest of the org, which is fine for scratch work and terrible as a habit. Work that matters should not live somewhere that disappears when the person leaves.
There is also a default public folder that catches reports saved without a deliberate choice. In most inherited orgs it contains hundreds of reports nobody owns, shared with everyone. Cleaning it up is tedious and worth doing once, because it is the most likely place for an accidental exposure.
A workable structure
Four or five top-level folders based on audience, not on object. “Sales Leadership”, “Sales Team”, “Support”, “Finance”, “Everyone”. Subfolders inside each for topic. One manager per folder who is a real person with a real job, not a distribution group.
Frequently asked
Why can a user edit a report I shared as viewer? Check their permissions before checking the folder. Manage Reports in Public Folders overrides the viewer level entirely.
Can I move a report between folders? Yes, and the report keeps its Id, so links continue to work. Access changes immediately to whatever the new folder allows, with no warning to anyone who loses it.
Do folders control access to the underlying data? No. They control access to the report. The data is governed by your sharing model, with the dashboard running user as the significant exception.
