Role-based access to reporting for divisional viewers

Description

We need to allow a small number of people in each division to view reporting for their division (and potentially export their subset). This could be achieved either by giving them access to “Central Ops reports” with scoped data, or by creating a dedicated divisional reporting space.

User story

As a divisional leader/analyst, I want to view reporting for my division only, so I can understand delivery status and risks without needing Central Ops to provide extracts.

Acceptance criteria

• A new role exists (or equivalent permission set), e.g. Reporting Viewer (Division).
• Users with this role can access reporting pages relevant to their scope.
• Users with this role can view only services within their division (no cross-division visibility).
• Central Ops retain full visibility across divisions.
• Access is manageable via admin UI/config (no manual DB edits required).
• Exports (if enabled) are scoped to the user’s division.

Tasks

• Decide approach:
  • Option A: reuse Central Ops report pages with scope enforced by RBAC - should anyone be able to see anyone elses items?
  • Option B: create “Divisional reports” area with tailored defaults
• Define roles + permission rules.
• Implement scoping enforcement at query layer (not just UI filtering).
• Add an admin mechanism to assign a user to a division scope.
• Add tests for access boundaries

Dependencies / notes

• Useful prerequisite for Issue 3 directorate reports.

Start by locating the existing Central Ops reporting pages, RBAC or permission definitions, division assignment/configuration, and query and export paths. Resolve whether to reuse the current reports or create a divisional area, then define the role and scope rules. Done means division-only visibility and exports, full Central Ops access, admin-managed assignment, and tests for access boundaries.