I'd like to see an access control selector like Views where admin can choose to restrict by role or by permission. the default can be by permission and 'view custom reports' perm so the change is backwards compatible.

We might also offer the option to create a permission for a given report so that admin can configure which roles get it.