I have set up a user as a Generator and in my tree have given access to certain line items in the tree for that user.    Why is this user able to generate a report and see all sections of the tree when I have not given them access?   How do we restrict access on reports to Generator roles?