Permissions are set per user role under the Sales group. Each report has its own switch:

• Sales – Gross Sales
• Profit & Loss – Profit And Loss Report
• Cashflow – Cash Flow report
• Sales Metrics – shows/hides the Orders Metrics menu link only (see note below)
• Wholesale – Wholesale - Sales
• Grab&Go Wholesale / Grab&Go Retail – Wholesale - G&G / Retail - G&G
• Reseller – Pickup
• Taxes – Taxes (and JTR Custom Tax)
• Meal – Meals (also used for the Meals by Vendor menu entry)
• Sales Meals Vendor – Meals by Vendor page itself
• Pack – Packs
• Affiliates – Affiliates Report (needs the Affiliates module)
• SMS – SMS report (needs the SMS module)
• Delivery, Fees, Sales Conversion, First Time Users, Sales Abandoned Carts, Sales Referred Users – the reports of the same name

A user who opens most report addresses directly without the matching permission is redirected to the admin dashboard. There are two exceptions in the current version: the First Time report's menu link doesn't check its permission at all (though the page itself still blocks unauthorized users), and Orders Metrics is served by a separate part of the app that only checks whether the user is any kind of admin/staff member – it does not check the "Sales Metrics" permission at the page level, so any staff user who knows the address can open it even with that permission unchecked. Note that Meals by Vendor effectively needs both Meal (to see the menu link) and Sales Meals Vendor (to open the page).