diff --git a/app/Domains/Reporting/Http/Requests/CustomerStatementRequest.php b/app/Domains/Reporting/Http/Requests/CustomerStatementRequest.php
index aa6dcc31..59ddc9ef 100644
--- a/app/Domains/Reporting/Http/Requests/CustomerStatementRequest.php
+++ b/app/Domains/Reporting/Http/Requests/CustomerStatementRequest.php
@@ -10,7 +10,9 @@ use Illuminate\Validation\Rule;
 class CustomerStatementRequest extends FormRequest
 {
     /**
-     * Determine if the user is authorized to make this request.
+     * Nothing is decided here: the controller weighs the customer and the
+     * report ability before any statement is drawn up, which leaves this
+     * class to shape and default the parameters it is handed.
      */
     public function authorize(): bool
     {
@@ -18,7 +20,7 @@ class CustomerStatementRequest extends FormRequest
     }
 
     /**
-     * Get the validation rules that apply to the request.
+     * Which statement is wanted, over which window, and how much of it.
      *
      * @return array<string, mixed>
      */
diff --git a/app/Domains/Reporting/Http/Requests/SendCustomerStatementRequest.php b/app/Domains/Reporting/Http/Requests/SendCustomerStatementRequest.php
index cdcc4ee4..f91b3df9 100644
--- a/app/Domains/Reporting/Http/Requests/SendCustomerStatementRequest.php
+++ b/app/Domains/Reporting/Http/Requests/SendCustomerStatementRequest.php
@@ -10,7 +10,9 @@ use Illuminate\Validation\Rule;
 class SendCustomerStatementRequest extends FormRequest
 {
     /**
-     * Determine if the user is authorized to make this request.
+     * Left open deliberately. Whether this caller may see the account at
+     * all is settled by the controller, ahead of the statement being
+     * built; the shape of the payload is all that is settled here.
      */
     public function authorize(): bool
     {
@@ -18,7 +20,7 @@ class SendCustomerStatementRequest extends FormRequest
     }
 
     /**
-     * Get the validation rules that apply to the request.
+     * The statement to draw up, together with the message it travels in.
      *
      * @return array<string, mixed>
      */
diff --git a/app/Domains/Reporting/ReportingServiceProvider.php b/app/Domains/Reporting/ReportingServiceProvider.php
index 98ff00a2..2062accd 100644
--- a/app/Domains/Reporting/ReportingServiceProvider.php
+++ b/app/Domains/Reporting/ReportingServiceProvider.php
@@ -11,7 +11,13 @@ class ReportingServiceProvider extends ServiceProvider
 {
     public function boot(): void
     {
-        Gate::define('view dashboard', [DashboardPolicy::class, 'view']);
-        Gate::define('view report', [ReportPolicy::class, 'viewReport']);
+        $reportingAbilities = [
+            'view dashboard' => [DashboardPolicy::class, 'view'],
+            'view report' => [ReportPolicy::class, 'viewReport'],
+        ];
+
+        foreach ($reportingAbilities as $ability => $handler) {
+            Gate::define($ability, $handler);
+        }
     }
 }
diff --git a/app/Domains/Reporting/routes/web.php b/app/Domains/Reporting/routes/web.php
index e87b51b1..f5841905 100644
--- a/app/Domains/Reporting/routes/web.php
+++ b/app/Domains/Reporting/routes/web.php
@@ -9,8 +9,18 @@ use App\Domains\Reporting\Http\Controllers\TaxSummaryReportController;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/customers/{customer}/statement', CustomerStatementReportController::class);
-Route::get('/sales/customers/{hash}', CustomerSalesReportController::class);
-Route::get('/sales/items/{hash}', ItemSalesReportController::class);
-Route::get('/expenses/{hash}', ExpensesReportController::class);
-Route::get('/tax-summary/{hash}', TaxSummaryReportController::class);
-Route::get('/profit-loss/{hash}', ProfitLossReportController::class);
+
+// Each financial report is addressed by the hash of the company it covers.
+// The hash names the company and nothing more: the controllers still check
+// the session for the report ability and for membership of that company.
+$hashedReports = [
+    '/sales/customers' => CustomerSalesReportController::class,
+    '/sales/items' => ItemSalesReportController::class,
+    '/expenses' => ExpensesReportController::class,
+    '/tax-summary' => TaxSummaryReportController::class,
+    '/profit-loss' => ProfitLossReportController::class,
+];
+
+foreach ($hashedReports as $path => $controller) {
+    Route::get($path.'/{hash}', $controller);
+}