Using local admin wasn't really a 'strategy', it was more of a Forlorn Hope just to get the job done while I found a sway to do it correctly. 🙂

Reports are organized in 18 folders and that hierarchy is reflected in the application that users experience. A *very* few users have the requirement and skills to make limited changes to the standard reports by opening them and saving copies with new names. That's the access I'd like to control with groups.

I'll look at the approach you describe.