Sharing model
Sharing works like Google Docs: invite individuals or groups as Viewer or Editor, share by link, or publish publicly.
A report and its data sources are separate objects with separate permissions. Sharing the report does not automatically grant access to the underlying source — which is why a colleague may open a report and see nothing but errors.
Owner vs. viewer credentials
This is the setting that matters most, configured per data source.
Owner credentials mean everyone queries the source as the source owner. Viewers need no access to the underlying data. This is how you share a BigQuery-backed report with people who have no BigQuery access — and it means anyone who can see the report can see all the data behind it.
Viewer credentials mean each person queries as themselves. They must have their own access, and they see only what their own permissions allow. This is how you get row-level-style security, by relying on the source system's permissions.
Choosing owner credentials on a sensitive source and then sharing broadly is the most common data-exposure mistake in Looker Studio.
Embedding and delivery
Embed produces an iframe snippet. Embedded reports respect the same permissions — embed a report that requires viewer credentials on a public page and visitors will see an error, not data.
Scheduled email delivery sends a PDF on a schedule to a list of recipients. Download as PDF handles one-off exports.
For public dashboards, set the report to public link sharing and use owner credentials — accepting that all data behind it is effectively public.
Templates and reuse
Make a copy lets you swap the data source, which is the basis of report templates — build once, copy per client, repoint the source.
The Data control achieves something similar without copying, letting a viewer select which account to view within one report. For agencies, the data control approach is usually less maintenance.