I finally began playing around with how to secure models and/or items within a model, so I needed a “testuser” to launch IE under in order to test my changes.
Much to my chagrin, testuser didn’t even get the Report Builder button displayed in the Report Manager UI even though I had added him to the new Report Builder role of 2005. I found I had to actually add testuser to the Publisher role, too – which seemed counter-intuitive. I asked around, and Tudor Trufinescu pointed me to what I was doing wrong. It turns out that there is a new permission in the System User role which allows the execution of reports via Report Builder.
I removed testuser from the Publisher role (to clean things up), added him to System User, and lo and behold, the Report Builder button appeared. I then turned on My Reports, added the user to the My Reports role, and got what I was looking for: The ability for testuser to see a limited number of entities/attributes in the model and use them to create a report. Testuser could also save the report to /My Reports, but nowhere else. Thanks Tudor!