We had similar requirements with regard to the report metadata including the ability to manage security and report categories within the application.

With that in mind we decided to...