Comprehensive and Detailed Explanation (Paraphrased from Workday Pro HCM Core – Reporting and Security Configuration Guide, 2023R2):

In Workday, the ability to share a report depends on a user or group’s security access to the report’s data source and data source filters . This ensures that only authorized individuals can view the report’s content, even if they have the link or the report is shared with them directly.

Data sources define what underlying information a report can pull (e.g., Worker, Position, Organization). Security policies tied to those data sources control who can access or view specific data fields. Therefore, even if a report is shared broadly, users can only see results their security permissions allow.

Options A, B, and D are incorrect because Workday security doesn’t evaluate “business reasons” or “tags” for access — it enforces data-source–based controls. Field-level access is governed by the domain security policy within the data source.

Reference (Paraphrased Source):

Workday Pro HCM Core – Reporting Configuration Guide (2023R2), Section: “Report Sharing and Security Dependencies.”