OTBI Data Security Not Aligning with HCM UI Security Profile

Dear Team,

We have a business user who has been assigned a security profile that restricts access to view only employees within a specific AOR or Legal Entity. This security setup is working correctly when accessed through HCM UIs like Person Management.

However, when the same user accesses the OTBI (Oracle Transactional Business Intelligence) interface to create or run reports, they are able to view HR data beyond their assigned Legal Entity and AOR restrictions.

How is data security enforced within OTBI reports? : Shouldn’t the OTBI tool inherit the same data security policies applied to the application user’s session? Or is there a different mechanism at play for securing data access within OTBI?