Currently through Report Admin you can only assign access by report category and type.  E.g., category = forms/commerce and report type = registrants - by item.  However, this includes many actual reports.  I realize that the report itself is canned and the data is fit into the report format.  Nonetheless, there should be much more granularity.  For instance, we have some parents in the parent association that we would like to have access to a registrants - by item report but only for a parent-run event.  If we grant them permission to this report type they have access to a ton of reports that they should not see.