And the day after you've formed these groups, Rob & Tom get promoted, your boss is charged with embezzlement, and the new CIO re-defines who gets which reports. So you have to run your grouping routine all over again.

This is not a big problem. 1,000 users - create a database called "user_reports" and store the information report-wise, that is, who is allowed to see report 'x'. It could be an rdbms, or just simply a text file with a list of user names. You'll find that searching 1,000 records for a given report takes practically no time at all.