User groups should only have access to correlation reports that are part of their user group permissions. They should not have access to all active correlation reports. For example if I have excluded a specific custom traffic variable report for a specific user group, they should not be able to access that custom traffic variable through a correlation report.