How to grant report schedule permissions without delete rights

Common least-privilege pattern: allow schedules and downloads, block deleting generated runs or templates.

Steps

1. Open Roles and edit the target role.
2. Enable report read + schedule/generate permissions required for recurring PDFs.
3. Leave report delete (and any purge/manage-destructive keys) unchecked.
4. Save and assign the role to the reporting owner.
5. Verify they can open Reporting, create a schedule on a ready template, and download runs — but cannot delete historical runs.

Outcome

Reporting continues safely without giving cleanup/delete rights to every scheduler.