If a user has access to an Ispec that contains a Run logic command to initiate a Report, then that Report is always initiated (whether that Report name appears in the user security list or not).