So, we have role-based and hierarchical reporting within the system, but anyone can export anything (and everything!) whenever they want. I would call this a bug from a design perspective, but there's no option to flag it as such so I'm hoping you guys see this soon!