On the Administration page, the "Manage Report Elements" link is visible to all users no matter their privileges. If you click on it, it then prompts for a username / password. If the user doesn't have the privileges to see what's behind the link, they should not see the link either to simplify things. It requires the "Manage Report Objects" privilege per the catalina log.
WARN - RequireTag.doStartTag(109) |2010-05-12 10:43:30,055| The user: 'myuser' has attempted to access: /admin/reports/reportObject.list which requires privilege: Manage Report Objects or one of: null or any of null