Everything follows Confluence permissions — no second permission model to maintain. A Metadata Report only lists pages the person viewing it already has access to, so the same macro on the same page shows a different set of rows to different people. Nothing leaks from restricted spaces.
