# [Feature Request] Restrict standard users to view only their own Alerts & Reports in the subscription list

[htcnokia]

Description

Currently, in the Alerts & Reports list view, standard (non-admin) users can see all configured email reports and alerts created across the entire workspace/organization.

Allowing standard users to view all reports and alerts across the system creates several issues:

1. Data Privacy & Security: Report configurations may reveal sensitive query parameters, chart titles, recipient email lists, or dashboard structures that a user might not otherwise have permission to view.
2. Clutter & Poor UX: Users are exposed to dozens or hundreds of irrelevant report configurations created by other team members, making it difficult to find and manage their own subscriptions.

Desired Behavior / Proposed Solution

1. User-Level Filtering by Default: Non-admin users should only see reports and alerts where they are listed as the Owner or Created By user.
2. Role-Based Access Control (RBAC):

• Admin / Alpha (with explicit manage permissions): Retain global visibility to view, edit, or delete all system alerts and reports.
• Gamma / Standard Users: Scope the fetch query for the Alerts & Reports table to created_by_fk == current_user_id (or filter by ownership).

3. Backend Enforcement: Ensure the API endpoint (/api/v1/report/) enforces row-level filtering based on the requesting user's role and ID, rather than relying solely on frontend list filtering.

Benefits

• Enhanced Security & Privacy: Prevents unintended disclosure of report schedules, recipient lists, and query metadata.
• Cleaner Interface: Provides users with a focused view containing only the alerts and reports relevant to them.

Environment

• Superset version: 6.1.0
• Feature: Alerts & Reports Management (/report/list/)

---