1. A method implemented by a computing system in response to execution of program code by a processor of the computing system, comprising: receiving a request from a user to start a report associated with a node of a business object object model, where the node of the business object object model is associated with an access control list associating instances of the node with at least one access context restriction; determining a first access context restriction associated with the user; retrieving at least one instance of the node based on the first access context restriction and on the access control list associated with the node; and presenting an instance of the report to the user, the instance of the report populated with the at least one instance.