How do you ensure that any access security is propagated to any reporting layer?

Authentication and authorization happens on a backend API layer in real-time, and changes are propagated in real-time.