I never do anything except RDS reports (mostly so there's no DSN, etc.) - so I can't help. RDS reports are filled from DF code (or embedded SQL) so the developer has complete control over what data is being accessed.