diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
index 2140829318..29381443fc 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt
@@ -393,7 +393,16 @@
                                                                         ></li
                                                                     >
                                                                     <li>
-                                                                        <a href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show" class="dropdown-item preview_sql" data-reportid="[% savedreport.id | html %]">
+                                                                        <a
+                                                                            [% # tags below to remove extra whitespace added for readability %]
+                                                                            [%- " "|$raw -%]href="/cgi-bin/koha/reports/guided_reports.pl?id=[% savedreport.id | uri %]&op=show"
+                                                                            [%- " "|$raw -%]class="dropdown-item preview_sql"
+                                                                            [%- " "|$raw -%]data-reportid="[% savedreport.id | html %]"
+                                                                            [%- " "|$raw -%]data-create="[% CAN_user_reports_create_reports || 0 | html %]"
+                                                                            [%- " "|$raw -%]data-delete="[% CAN_user_reports_delete_reports || 0 | html %]"
+                                                                            [%- " "|$raw -%]data-run="[% CAN_user_reports_execute_reports || 0 | html %]"
+                                                                            [%- ""|$raw -%]
+                                                                        >
                                                                             <i class="fa-solid fa-eye" aria-hidden="true"></i> Preview SQL
                                                                         </a>
                                                                     </li>
@@ -1580,7 +1589,9 @@
 
                         <fieldset class="action">
                             <button class="btn btn-primary" type="submit" name="op" value="cud-update_sql">Update SQL</button>
-                            [% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %]
+                            [% IF ( CAN_user_reports_create_reports && CAN_user_reports_execute_reports ) %]
+                                [% INCLUDE 'throttled-button.inc' element_type='button' classes='btn btn-default' label=t('Update and run SQL') attrs={ name => 'op', value => 'cud-update_and_run_sql' } %]
+                            [% END %]
                             <a href="/cgi-bin/koha/reports/guided_reports.pl?op=list" class="cancel">Cancel</a>
                         </fieldset>
                     </form>
@@ -2471,8 +2482,8 @@
 
             $("body").on("click", ".preview_sql", function(e){
                 e.preventDefault();
-                var reportid = $(this).data("reportid");
-                previewSql( reportid );
+                var report_data = $(this).data();
+                previewSql(report_data);
             });
             $(".limitselect").on("click", function(){
                 var limit = $(this).data("limit");
@@ -2628,10 +2639,14 @@
         }
 
         // Adapted from https://gist.github.com/jnormore/7418776
-        function previewSql(reportid) {
-            var message = $("#previewSql" + reportid ).val();
-            var title = $("#previewSql" + reportid ).data("title");
-            if( $("#preview-sql-modal").length > 0) {
+        function previewSql(report_data) {
+            var reportid = report_data.reportid;
+            var can_create = report_data.create;
+            var can_delete = report_data.delete;
+            var can_run = report_data.run;
+            var message = $("#previewSql" + reportid).val();
+            var title = $("#previewSql" + reportid).data("title");
+            if ($("#preview-sql-modal").length > 0) {
                 $("#preview-sql-modal").remove();
             }
 
@@ -2647,18 +2662,32 @@
                 textContent: message
             });
 
-            clone.querySelector('[data-placeholder="edit-href"]').href = '/cgi-bin/koha/reports/guided_reports.pl?id=' + encodeURIComponent(reportid) + '&op=edit_form';
-            clone.querySelector('[data-placeholder="duplicate-href"]').href = '/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=' + encodeURIComponent(reportid);
-            clone.querySelector('[data-placeholder="schedule-href"]').href = '/cgi-bin/koha/tools/scheduler.pl?id=' + encodeURIComponent(reportid);
+            if (can_run) {
+                clone.querySelector('[data-placeholder="run-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=run";
+                clone.querySelector('[data-placeholder="schedule-href"]').href = "/cgi-bin/koha/tools/scheduler.pl?id=" + encodeURIComponent(reportid);
+            } else {
+                clone.querySelector("#preview-modal-runreport").remove();
+                clone.querySelector("#preview-modal-schedule").remove();
+            }
 
-            Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, {
-                id: reportid,
-                action: 'guided_reports.pl',
-                method: 'post',
-                op: 'cud-delete'
-            });
+            if (can_create) {
+                clone.querySelector('[data-placeholder="edit-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?id=" + encodeURIComponent(reportid) + "&op=edit_form";
+                clone.querySelector('[data-placeholder="duplicate-href"]').href = "/cgi-bin/koha/reports/guided_reports.pl?op=duplicate&id=" + encodeURIComponent(reportid);
+            } else {
+                clone.querySelector("#preview-modal-editreport").remove();
+                clone.querySelector("#preview-modal-duplicate").remove();
+            }
 
-            clone.querySelector('[data-placeholder="run-href"]').href = '/cgi-bin/koha/reports/guided_reports.pl?id=' + encodeURIComponent(reportid) + '&op=run';
+            if (can_delete) {
+                Object.assign(clone.querySelector('[data-placeholder="delete-attrs"]').dataset, {
+                    id: reportid,
+                    action: "guided_reports.pl",
+                    method: "post",
+                    op: "cud-delete",
+                });
+            } else {
+                clone.querySelector("#preview-modal-delete").remove();
+            }
 
             document.body.appendChild(clone);
 
@@ -2688,7 +2717,7 @@
                     <a id="preview-modal-editreport" class="btn btn-default" data-placeholder="edit-href"><i class="fa-solid fa-pencil" aria-hidden="true"></i> Edit</a>
                     <a id="preview-modal-duplicate" class="btn btn-default" data-placeholder="duplicate-href"><i class="fa fa-copy" aria-hidden="true"></i> Duplicate</a>
                     <a id="preview-modal-schedule" class="btn btn-default" data-placeholder="schedule-href"><i class="fa-solid fa-clock" aria-hidden="true"></i> Schedule</a>
-                    <a class="btn btn-default submit-form-link" href="#" data-placeholder="delete-attrs" data-confirmation-msg="[% t('Are you sure you want to delete this report?') | html %]"
+                    <a id="preview-modal-delete" class="btn btn-default submit-form-link" href="#" data-placeholder="delete-attrs" data-confirmation-msg="[% t('Are you sure you want to delete this report?') | html %]"
                         ><i class="fa fa-trash-can" aria-hidden="true"></i> Delete</a
                     >
                     [% INCLUDE 'throttled-button.inc' element_type='link' id='preview-modal-runreport' classes='btn btn-default' label=t('Run report') attrs={ 'data-placeholder' => 'run-href' } %]
diff --git a/reports/guided_reports.pl b/reports/guided_reports.pl
index d1444a7c6e..065b31027f 100755
--- a/reports/guided_reports.pl
+++ b/reports/guided_reports.pl
@@ -58,15 +58,18 @@ my $usecache = Koha::Caches->get_instance->memcached_cache;
 
 my $op = $input->param('op') // '';
 my $flagsrequired;
-if (   ( $op eq 'add_form' )
-    || ( $op eq 'add_form_sql' )
-    || ( $op eq 'edit_form' )
-    || ( $op eq 'duplicate' ) )
+if (   $op eq 'add_form'
+    || $op eq 'add_form_sql'
+    || $op eq 'edit_form'
+    || $op eq 'duplicate'
+    || $op eq 'cud-save'
+    || $op eq 'cud-update_sql'
+    || $op eq 'cud-update_and_run_sql' )
 {
     $flagsrequired = 'create_reports';
 } elsif ( $op eq 'list' ) {
     $flagsrequired = 'execute_reports';
-} elsif ( $op eq 'delete' ) {
+} elsif ( $op eq 'cud-delete' ) {
     $flagsrequired = 'delete_reports';
 } else {
     $flagsrequired = '*';