I've recently run into a user's request that raised more than a few alarm bells for me. They want to create layouts for reporting for a solution I built and provided to them. I've always managed the all the behind the scenes (security, hosting, scripts, layouts, etc.) for them. I poked around in security a bit, and it looks like I can lock up most of the work that I've done so they won't be able to modify existing layouts, can see security or scripts. But I can't prevent from creating a new layout and adding modifiable fields from other tables, or duplicating a layout and then modifying it. Most of it would be ok, but this is new territory for me.
What issues have others here run into when providing new layout creation to a user?