diff --git a/cmd/server/pactasrv/analysis.go b/cmd/server/pactasrv/analysis.go
index b0b16c0..d8b8ef1 100644
--- a/cmd/server/pactasrv/analysis.go
+++ b/cmd/server/pactasrv/analysis.go
@@ -25,6 +25,16 @@ func (s *Server) ListAnalyses(ctx context.Context, request api.ListAnalysesReque
 	if err != nil {
 		return nil, oapierr.Internal("failed to query analyses", zap.Error(err))
 	}
+	if err := s.populateArtifactsInAnalyses(ctx, as...); err != nil {
+		return nil, err
+	}
+	artifacts := []*pacta.AnalysisArtifact{}
+	for _, a := range as {
+		artifacts = append(artifacts, a.Artifacts...)
+	}
+	if err := s.populateBlobsInAnalysisArtifacts(ctx, artifacts...); err != nil {
+		return nil, err
+	}
 	items, err := dereference(conv.AnalysesToOAPI(as))
 	if err != nil {
 		return nil, err
diff --git a/cmd/server/pactasrv/conv/pacta_to_oapi.go b/cmd/server/pactasrv/conv/pacta_to_oapi.go
index d6511cf..62588d1 100644
--- a/cmd/server/pactasrv/conv/pacta_to_oapi.go
+++ b/cmd/server/pactasrv/conv/pacta_to_oapi.go
@@ -314,8 +314,18 @@ func FileTypeToOAPI(ft pacta.FileType) (api.FileType, error) {
 		return api.FileTypeJSON, nil
 	case pacta.FileType_HTML:
 		return api.FileTypeHTML, nil
-	}
-	return "", fmt.Errorf("unknown file type: %q", ft)
+	case pacta.FileType_TEXT:
+		return api.FileTypeTEXT, nil
+	case pacta.FileType_CSS:
+		return api.FileTypeCSS, nil
+	case pacta.FileType_JS:
+		return api.FileTypeJS, nil
+	case pacta.FileType_TTF:
+		return api.FileTypeTTF, nil
+	case pacta.FileType_UNKNOWN:
+		return api.FileTypeUNKNOWN, nil
+	}
+	return api.FileTypeUNKNOWN, nil
 }
 
 func BlobToOAPI(b *pacta.Blob) (*api.Blob, error) {
diff --git a/db/sqldb/blob.go b/db/sqldb/blob.go
index 2593ed2..e65659f 100644
--- a/db/sqldb/blob.go
+++ b/db/sqldb/blob.go
@@ -32,6 +32,9 @@ func (d *DB) Blob(tx db.Tx, id pacta.BlobID) (*pacta.Blob, error) {
 }
 
 func (d *DB) Blobs(tx db.Tx, ids []pacta.BlobID) (map[pacta.BlobID]*pacta.Blob, error) {
+	if len(ids) == 0 {
+		return map[pacta.BlobID]*pacta.Blob{}, nil
+	}
 	ids = dedupeIDs(ids)
 	rows, err := d.query(tx, `
 		SELECT `+blobSelectColumns+`
diff --git a/frontend/components/analysis/Editor.vue b/frontend/components/analysis/Editor.vue
new file mode 100644
index 0000000..af2b878
--- /dev/null
+++ b/frontend/components/analysis/Editor.vue
@@ -0,0 +1,44 @@
+<script setup lang="ts">
+import {
+  type EditorAnalysisFields as EditorFields,
+  type EditorAnalysisValues as EditorValues,
+} from '@/lib/editor'
+
+interface Props {
+  editorValues: EditorValues
+  editorFields: EditorFields
+}
+interface Emits {
+  (e: 'update:editorValues', evs: EditorValues): void
+}
+const props = defineProps<Props>()
+const emit = defineEmits<Emits>()
+
+const efs = computed(() => props.editorFields)
+const evs = computed({
+  get: () => props.editorValues,
+  set: (evs) => { emit('update:editorValues', evs) },
+})
+</script>
+
+<template>
+  <div>
+    <FormEditorField
+      :editor-field="efs.name"
+      :editor-value="evs.name"
+    >
+      <PVInputText
+        v-model="evs.name.currentValue"
+      />
+    </FormEditorField>
+    <FormEditorField
+      :editor-field="efs.description"
+      :editor-value="evs.description"
+    >
+      <PVTextarea
+        v-model="evs.description.currentValue"
+        auto-resize
+      />
+    </FormEditorField>
+  </div>
+</template>
diff --git a/frontend/components/analysis/ListView.vue b/frontend/components/analysis/ListView.vue
new file mode 100644
index 0000000..c4d67d2
--- /dev/null
+++ b/frontend/components/analysis/ListView.vue
@@ -0,0 +1,194 @@
+<script setup lang="ts">
+import { analysisEditor } from '@/lib/editor'
+import { type Portfolio, type PortfolioGroup, type Initiative, type Analysis } from '@/openapi/generated/pacta'
+import { selectedCountSuffix } from '@/lib/selection'
+
+const { public: { apiServerURL } } = useRuntimeConfig()
+const {
+  humanReadableTimeFromStandardString,
+} = useTime()
+const pactaClient = usePACTA()
+const { loading: { withLoading } } = useModal()
+const i18n = useI18n()
+const { t } = i18n
+
+interface Props {
+  portfolios: Portfolio[]
+  portfolioGroups: PortfolioGroup[]
+  initiatives: Initiative[]
+  analyses: Analysis[]
+  selectedPortfolioIds: string[]
+  selectedPortfolioGroupIds: string[]
+  selectedAnalysisIds: string[]
+}
+const props = defineProps<Props>()
+interface Emits {
+  (e: 'update:selectedPortfolioIds', value: string[]): void
+  (e: 'update:selectedPortfolioGroupIds', value: string[]): void
+  (e: 'update:selectedAnalysisIds', value: string[]): void
+  (e: 'refresh'): void
+}
+const emit = defineEmits<Emits>()
+
+const refresh = () => { emit('refresh') }
+
+const selectedAnalysisIDs = computed({
+  get: () => props.selectedAnalysisIds ?? [],
+  set: (value: string[]) => { emit('update:selectedAnalysisIds', value) },
+})
+
+interface EditorObject extends ReturnType<typeof analysisEditor> {
+  id: string
+}
+
+const prefix = 'components/analysis/ListView'
+const tt = (s: string) => t(`${prefix}.${s}`)
+const expandedRows = useState<EditorObject[]>(`${prefix}.expandedRows`, () => [])
+const selectedRows = computed<EditorObject[]>({
+  get: () => {
+    const ids = selectedAnalysisIDs.value
+    return editorObjects.value.filter((editorObject) => ids.includes(editorObject.id))
+  },
+  set: (value: EditorObject[]) => {
+    const ids = value.map((row) => row.id)
+    ids.sort()
+    selectedAnalysisIDs.value = ids
+  },
+})
+
+const editorObjects = computed<EditorObject[]>(() => props.analyses.map((item) => ({ ...analysisEditor(item, i18n), id: item.id })))
+
+const selectedAnalyses = computed<Analysis[]>(() => selectedRows.value.map((row) => row.currentValue.value))
+
+const saveChanges = (id: string) => {
+  const index = editorObjects.value.findIndex((editorObject) => editorObject.id === id)
+  const eo = presentOrFileBug(editorObjects.value[index])
+  return withLoading(
+    () => pactaClient.updateAnalysis(id, eo.changes.value).then(refresh),
+    `${prefix}.saveChanges`,
+  )
+}
+
+const deleteAnalysis = (id: string) => withLoading(
+  () => pactaClient.deleteAnalysis(id),
+  `${prefix}.deleteAnalysis`,
+)
+const deleteSelected = () => Promise.all([selectedRows.value.map((row) => deleteAnalysis(row.id))]).then(refresh)
+</script>
+
+<template>
+  <div class="flex flex-column gap-3">
+    <div class="flex gap-2 flex-wrap">
+      <PVButton
+        icon="pi pi-refresh"
+        class="p-button-outlined p-button-secondary p-button-sm"
+        :label="tt('Refresh')"
+        @click="refresh"
+      />
+      <PVButton
+        :disabled="!selectedRows || selectedRows.length === 0"
+        icon="pi pi-trash"
+        class="p-button-outlined p-button-danger p-button-sm"
+        :label="tt('Delete') + selectedCountSuffix(selectedRows)"
+        @click="deleteSelected"
+      />
+    </div>
+    <PVDataTable
+      v-model:selection="selectedRows"
+      v-model:expanded-rows="expandedRows"
+      :value="editorObjects"
+      data-key="id"
+      size="small"
+      sort-field="editorValues.value.createdAt.originalValue"
+      :sort-order="-1"
+    >
+      <PVColumn selection-mode="multiple" />
+      <PVColumn
+        field="editorValues.value.createdAt.originalValue"
+        :header="tt('Created At')"
+        sortable
+      >
+        <template #body="slotProps">
+          {{ humanReadableTimeFromStandardString(slotProps.data.editorValues.value.createdAt.originalValue).value }}
+        </template>
+      </PVColumn>
+      <PVColumn
+        field="editorValues.value.name.originalValue"
+        sortable
+        :header="tt('Name')"
+      />
+      <PVColumn
+        :header="tt('View')"
+      >
+        <template #body="slotProps">
+          <LinkButton
+            icon="pi pi-external-link"
+            class="p-button-outlined p-button-xs"
+            :label="tt('View')"
+            :to="`${apiServerURL}/report/${slotProps.data.id}`"
+            new-tab
+          />
+        </template>
+      </PVColumn>
+      <PVColumn
+        expander
+        :header="tt('Details')"
+      />
+      <template
+        #expansion="slotProps"
+      >
+        <div class="surface-100 p-3">
+          <h2 class="mt-0">
+            {{ tt('Metadata') }}
+          </h2>
+          <StandardDebug
+            always
+            :value="slotProps.data.currentValue.value"
+            label="Raw Data"
+          />
+          <h2 class="mt-5">
+            {{ tt('Editable Properties') }}
+          </h2>
+          <AnalysisEditor
+            v-model:editor-values="slotProps.data.editorValues.value"
+            :editor-fields="slotProps.data.editorFields.value"
+          />
+          <div class="flex gap-3 justify-content-between">
+            <PVButton
+              icon="pi pi-trash"
+              class="p-button-danger p-button-outlined"
+              :label="tt('Delete')"
+              @click="() => deleteAnalysis(slotProps.data.id)"
+            />
+            <div v-tooltip.bottom="slotProps.data.saveTooltip">
+              <PVButton
+                :disabled="!slotProps.data.canSave.value"
+                :label="tt('Save Changes')"
+                icon="pi pi-save"
+                icon-pos="right"
+                @click="() => saveChanges(slotProps.data.id)"
+              />
+            </div>
+          </div>
+        </div>
+      </template>
+    </PVDataTable>
+    <div class="flex flex-wrap gap-3 w-full justify-content-between">
+      <!-- TODO(grady) Hook this up to something. -->
+      <PVButton
+        class="p-button-outlined"
+        :label="tt('How To Run a Report')"
+        icon="pi pi-question-circle"
+        icon-pos="right"
+      />
+    </div>
+    <StandardDebug
+      :value="selectedAnalyses"
+      label="Selected Analyses"
+    />
+    <StandardDebug
+      :value="props.analyses"
+      label="All Analyses"
+    />
+  </div>
+</template>
diff --git a/frontend/components/portfolio/ListView.vue b/frontend/components/portfolio/ListView.vue
index 0fb6821..03c12d5 100644
--- a/frontend/components/portfolio/ListView.vue
+++ b/frontend/components/portfolio/ListView.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { portfolioEditor } from '@/lib/editor'
-import { AnalysisType, type Portfolio, type PortfolioGroup, type Initiative } from '@/openapi/generated/pacta'
+import { AnalysisType, type Portfolio, type PortfolioGroup, type Initiative, type Analysis } from '@/openapi/generated/pacta'
 import { selectedCountSuffix } from '@/lib/selection'
 
 const {
@@ -16,13 +16,16 @@ interface Props {
   portfolios: Portfolio[]
   portfolioGroups: PortfolioGroup[]
   initiatives: Initiative[]
+  analyses: Analysis[]
   selectedPortfolioIds: string[]
   selectedPortfolioGroupIds: string[]
+  selectedAnalysisIds: string[]
 }
 const props = defineProps<Props>()
 interface Emits {
   (e: 'update:selectedPortfolioIds', value: string[]): void
   (e: 'update:selectedPortfolioGroupIds', value: string[]): void
+  (e: 'update:selectedAnalysisIds', value: string[]): void
   (e: 'refresh'): void
 }
 const emit = defineEmits<Emits>()
@@ -66,17 +69,20 @@ const saveChanges = (id: string) => {
   )
 }
 
-const runAnalysis = (id: string) => {
+const runAnalysis = (id: string, analysisType: AnalysisType) => {
+  const n = props.portfolios.find((p) => p.id === id)?.name ?? 'unknown'
   return withLoading(
     () => pactaClient.runAnalysis({
-      analysisType: AnalysisType.ANALYSIS_TYPE_REPORT,
-      name: 'Test Analysis!',
-      description: 'this is a test',
+      analysisType,
+      name: `${tt(analysisType)}: ${n}`,
+      description: `${tt(analysisType)} run at ${new Date().toLocaleString()} for portfolio ${n} (${id})`,
       portfolioId: id,
-    }).then(() => { emit('refresh') }),
-    `${prefix}.saveChanges`,
+    }),
+    `${prefix}.runPortfolioAnalysis`,
   )
 }
+const runAudit = (id: string) => runAnalysis(id, AnalysisType.ANALYSIS_TYPE_AUDIT)
+const runReport = (id: string) => runAnalysis(id, AnalysisType.ANALYSIS_TYPE_REPORT)
 
 const deletePortfolio = (id: string) => withLoading(
   () => pactaClient.deletePortfolio(id),
@@ -211,6 +217,20 @@ const deleteSelected = () => Promise.all([selectedRows.value.map((row) => delete
               @changed-memberships="refresh"
             />
           </div>
+          <h2 class="mt-5">
+            {{ tt('Analyses') }}
+          </h2>
+          <PVMessage severity="warn">
+            TODO - filter analyses by those that match this portfolio
+          </PVMessage>
+          <PVButton
+            :label="tt('Run Audit')"
+            @click="() => runAudit(slotProps.data.id)"
+          />
+          <PVButton
+            :label="tt('Run Report')"
+            @click="() => runReport(slotProps.data.id)"
+          />
           <h2 class="mt-5">
             {{ tt('Editable Properties') }}
           </h2>
@@ -234,10 +254,6 @@ const deleteSelected = () => Promise.all([selectedRows.value.map((row) => delete
                 @click="() => saveChanges(slotProps.data.id)"
               />
             </div>
-            <PVButton
-              label="Test Run Analysis"
-              @click="() => runAnalysis(slotProps.data.id)"
-            />
           </div>
         </div>
       </template>
diff --git a/frontend/components/portfolio/group/ListView.vue b/frontend/components/portfolio/group/ListView.vue
index 93feaf2..cccf0ab 100644
--- a/frontend/components/portfolio/group/ListView.vue
+++ b/frontend/components/portfolio/group/ListView.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { portfolioGroupEditor } from '@/lib/editor'
-import { type Portfolio, type PortfolioGroup, type PortfolioGroupMembershipPortfolio } from '@/openapi/generated/pacta'
+import { type Portfolio, type PortfolioGroup, type PortfolioGroupMembershipPortfolio, type Analysis } from '@/openapi/generated/pacta'
 import { selectedCountSuffix } from '@/lib/selection'
 
 const {
@@ -15,13 +15,16 @@ const { t } = i18n
 interface Props {
   portfolios: Portfolio[]
   portfolioGroups: PortfolioGroup[]
+  analyses: Analysis[]
   selectedPortfolioIds: string[]
   selectedPortfolioGroupIds: string[]
+  selectedAnalysisIds: string[]
 }
 const props = defineProps<Props>()
 interface Emits {
   (e: 'update:selectedPortfolioIds', value: string[]): void
   (e: 'update:selectedPortfolioGroupIds', value: string[]): void
+  (e: 'update:selectedAnalysisIds', value: string[]): void
   (e: 'refresh'): void
 }
 const emit = defineEmits<Emits>()
diff --git a/frontend/lang/en.json b/frontend/lang/en.json
index 8c0528a..3cfd794 100644
--- a/frontend/lang/en.json
+++ b/frontend/lang/en.json
@@ -26,6 +26,17 @@
     "Save Changes": "Save Changes",
     "Refresh": "Refresh"
   },
+  "components/analysis/ListView": {
+    "Created At": "Created At",
+    "Details": "Details",
+    "Name": "Name",
+    "Delete": "Delete",
+    "Metadata": "Metadata",
+    "Editable Properties": "Editable Properties",
+    "Save Changes": "Save Changes",
+    "Refresh": "Refresh",
+    "View": "View"
+  },
   "components/initiative/Toolbar": {
     "Edit": "Edit",
     "Initiative Home": "Initiative Home",
@@ -262,7 +273,8 @@
     "My Data": "My Data",
     "Portfolio Groups": "Portfolio Groups",
     "Portfolios": "Portfolios",
-    "Incomplete Uploads": "Incomplete Uploads"
+    "Incomplete Uploads": "Incomplete Uploads",
+    "Analyses": "Reports and Audits"
   },
   "pages/initiative/invitations": {
     "Yes Invitations": "This initiative requires an invitation (a unique, one-time code) to join. You can create and manage these invitations below.",
diff --git a/frontend/lib/editor/analysis.ts b/frontend/lib/editor/analysis.ts
new file mode 100644
index 0000000..8fea745
--- /dev/null
+++ b/frontend/lib/editor/analysis.ts
@@ -0,0 +1,67 @@
+import { type Analysis } from '@/openapi/generated/pacta'
+import { Validation, type EditorFieldsFor, type EditorValuesFor, type EditorComputedValues } from './common'
+import { getEditorComputedValues, type Translation } from './utils'
+
+export type EditorAnalysisFields = EditorFieldsFor<Analysis>
+export type EditorAnalysisValues = EditorValuesFor<Analysis>
+
+const createEditorAnalysisFields = (translation: Translation): EditorAnalysisFields => {
+  const tt = (key: string) => translation.t(`lib/editor/analysis.${key}`)
+  return {
+    id: {
+      name: 'id',
+      label: tt('ID'),
+    },
+    analysisType: {
+      name: 'analysisType',
+      label: tt('Analysis Type'),
+    },
+    pactaVersion: {
+      name: 'pactaVersion',
+      label: tt('PACTA Version'),
+    },
+    portfolioSnapshot: {
+      name: 'portfolioSnapshot',
+      label: tt('Portfolio Snapshot'),
+    },
+    name: {
+      name: 'name',
+      label: tt('Name'),
+      validation: [Validation.NotEmpty],
+      helpText: tt('NameHelpText'),
+    },
+    description: {
+      name: 'description',
+      label: tt('Description'),
+      helpText: tt('DescriptionHelpText'),
+    },
+    createdAt: {
+      name: 'createdAt',
+      label: tt('Created At'),
+    },
+    ranAt: {
+      name: 'ranAt',
+      label: tt('Ran At'),
+    },
+    completedAt: {
+      name: 'completedAt',
+      label: tt('Completed At'),
+    },
+    failureCode: {
+      name: 'failureCode',
+      label: tt('Failure Code'),
+    },
+    failureMessage: {
+      name: 'failureMessage',
+      label: tt('Failure Message'),
+    },
+    artifacts: {
+      name: 'artifacts',
+      label: tt('Artifacts'),
+    },
+  }
+}
+
+export const analysisEditor = (i: Analysis, translation: Translation): EditorComputedValues<Analysis> => {
+  return getEditorComputedValues(`lib/editor/analysis[${i.id}]`, i, createEditorAnalysisFields, translation)
+}
diff --git a/frontend/lib/editor/index.ts b/frontend/lib/editor/index.ts
index f1e409f..445ed2b 100644
--- a/frontend/lib/editor/index.ts
+++ b/frontend/lib/editor/index.ts
@@ -1,3 +1,4 @@
+export * from './analysis'
 export * from './common'
 export * from './incomplete_upload'
 export * from './initiative'
diff --git a/frontend/pages/my-data.vue b/frontend/pages/my-data.vue
index 0466ae2..66f1cf7 100644
--- a/frontend/pages/my-data.vue
+++ b/frontend/pages/my-data.vue
@@ -10,17 +10,20 @@ const tt = (s: string) => t(`${prefix}.${s}`)
 
 const selectedPortfolioIdsQP = fromQueryReactiveWithDefault('pids', '')
 const selectedPortfolioGroupIdsQP = fromQueryReactiveWithDefault('pgids', '')
+const selectedAnalysisIdsQP = fromQueryReactiveWithDefault('analyses', '')
 const tabQP = fromQueryReactiveWithDefault('tab', 'p')
 
 const [
   { data: incompleteUploadsData, refresh: refreshIncompleteUploadsApi },
   { data: portfolioData, refresh: refreshPortfoliosApi },
   { data: portfolioGroupData, refresh: refreshPortfolioGroupsApi },
+  { data: analysesData, refresh: refreshAnalysesApi },
   { data: initiativeData, refresh: refreshInitiativesApi },
 ] = await Promise.all([
   useSimpleAsyncData(`${prefix}.incompleteUploads`, () => pactaClient.listIncompleteUploads()),
   useSimpleAsyncData(`${prefix}.portfolios`, () => pactaClient.listPortfolios()),
   useSimpleAsyncData(`${prefix}.portfolioGroups`, () => pactaClient.listPortfolioGroups()),
+  useSimpleAsyncData(`${prefix}.analyses`, () => pactaClient.listAnalyses()),
   useSimpleAsyncData(`${prefix}.initiatives`, () => pactaClient.listInitiatives()),
 ])
 const refreshIncompleteUploads = async () => {
@@ -32,18 +35,19 @@ const refreshPortfolios = async () => {
 const refreshPortfolioGroups = async () => {
   await withLoading(refreshPortfolioGroupsApi, `${prefix}.refreshPortfolioGroups`)
 }
+const refreshAnalyses = async () => {
+  await withLoading(refreshAnalysesApi, `${prefix}.refreshAnalyses`)
+}
 const refreshInitiatives = async () => {
   await withLoading(refreshInitiativesApi, `${prefix}.refreshInitiatives`)
 }
-const refreshAll = async () => {
-  console.log('refreshing all')
-  await Promise.all([
-    refreshIncompleteUploads(),
-    refreshPortfolios(),
-    refreshPortfolioGroups(),
-    refreshInitiatives(),
-  ])
-}
+const refreshAll = () => Promise.all([
+  refreshIncompleteUploads(),
+  refreshPortfolios(),
+  refreshPortfolioGroups(),
+  refreshAnalyses(),
+  refreshInitiatives(),
+])
 
 const selectedPortfolioIds = computed<string[]>({
   get: () => selectedPortfolioIdsQP.value.split(','),
@@ -53,16 +57,22 @@ const selectedPortfolioGroupIds = computed<string[]>({
   get: () => selectedPortfolioGroupIdsQP.value.split(','),
   set: (v: string[]) => { selectedPortfolioGroupIdsQP.value = v.join(',') },
 })
+const selectedAnalysisIds = computed<string[]>({
+  get: () => selectedAnalysisIdsQP.value.split(','),
+  set: (v: string[]) => { selectedAnalysisIdsQP.value = v.join(',') },
+})
 interface TabToIndexMap {
   iu: number
   p: number
   pg: number
+  a: number
 }
 const tabToIndexMap = computed(() => {
   const result: TabToIndexMap = {
     iu: -1,
     p: -1,
     pg: -1,
+    a: -1,
   }
   let idx = 0
   if (incompleteUploadsData.value.items.length > 0) {
@@ -73,6 +83,12 @@ const tabToIndexMap = computed(() => {
   }
   result.p = idx++
   result.pg = idx++
+  if (analysesData.value.items.length > 0) {
+    result.a = idx
+    idx++
+  } else {
+    result.a = -1
+  }
   return result
 })
 const activeIndex = computed<number>({
@@ -135,8 +151,10 @@ const activeIndex = computed<number>({
           v-if="portfolioData && portfolioGroupData && initiativeData"
           v-model:selected-portfolio-group-ids="selectedPortfolioGroupIds"
           v-model:selected-portfolio-ids="selectedPortfolioIds"
+          v-model:selected-analysis-ids="selectedAnalysisIds"
           :portfolios="portfolioData.items"
           :portfolio-groups="portfolioGroupData.items"
+          :analyses="analysesData.items"
           :initiatives="initiativeData"
           @refresh="refreshAll"
         />
@@ -149,11 +167,34 @@ const activeIndex = computed<number>({
           </div>
         </template>
         <PortfolioGroupListView
-          v-if="portfolioData && portfolioGroupData && initiativeData"
+          v-if="portfolioData && portfolioGroupData && initiativeData && analysesData"
+          v-model:selected-portfolio-group-ids="selectedPortfolioGroupIds"
+          v-model:selected-portfolio-ids="selectedPortfolioIds"
+          v-model:selected-analysis-ids="selectedAnalysisIds"
+          :portfolios="portfolioData.items"
+          :portfolio-groups="portfolioGroupData.items"
+          :analyses="analysesData.items"
+          @refresh="refreshAll"
+        />
+      </PVTabPanel>
+      <PVTabPanel
+        v-if="(analysesData?.items ?? []).length > 0"
+      >
+        <template #header>
+          <div class="flex align-items-center gap-3">
+            <i class="pi pi-book" />
+            <div>{{ tt('Analyses') }}</div>
+          </div>
+        </template>
+        <AnalysisListView
+          v-if="portfolioData && portfolioGroupData && initiativeData && analysesData"
           v-model:selected-portfolio-group-ids="selectedPortfolioGroupIds"
           v-model:selected-portfolio-ids="selectedPortfolioIds"
+          v-model:selected-analysis-ids="selectedAnalysisIds"
           :portfolios="portfolioData.items"
           :portfolio-groups="portfolioGroupData.items"
+          :analyses="analysesData.items"
+          :initiatives="initiativeData"
           @refresh="refreshAll"
         />
       </PVTabPanel>
diff --git a/openapi/pacta.yaml b/openapi/pacta.yaml
index 2c2a7d8..e637efe 100644
--- a/openapi/pacta.yaml
+++ b/openapi/pacta.yaml
@@ -1016,6 +1016,11 @@ components:
         - FileTypeZIP
         - FileTypeJSON
         - FileTypeHTML
+        - FileTypeTEXT
+        - FileTypeCSS
+        - FileTypeJS
+        - FileTypeTTF
+        - FileTypeUNKNOWN
     AnalysisType:
       type: string
       enum:
diff --git a/reportsrv/BUILD.bazel b/reportsrv/BUILD.bazel
index cd682fa..31f2de8 100644
--- a/reportsrv/BUILD.bazel
+++ b/reportsrv/BUILD.bazel
@@ -9,6 +9,7 @@ go_library(
         "//blob",
         "//db",
         "//pacta",
+        "//session",
         "@com_github_go_chi_chi_v5//:chi",
         "@org_uber_go_zap//:zap",
     ],
diff --git a/reportsrv/reportsrv.go b/reportsrv/reportsrv.go
index 62a8601..fc53e72 100644
--- a/reportsrv/reportsrv.go
+++ b/reportsrv/reportsrv.go
@@ -11,6 +11,7 @@ import (
 	"github.com/RMI/pacta/blob"
 	"github.com/RMI/pacta/db"
 	"github.com/RMI/pacta/pacta"
+	"github.com/RMI/pacta/session"
 	"github.com/go-chi/chi/v5"
 	"go.uber.org/zap"
 )
@@ -43,8 +44,12 @@ type Server struct {
 type DB interface {
 	NoTxn(context.Context) db.Tx
 
+	Analysis(tx db.Tx, id pacta.AnalysisID) (*pacta.Analysis, error)
 	AnalysisArtifactsForAnalysis(tx db.Tx, id pacta.AnalysisID) ([]*pacta.AnalysisArtifact, error)
 	Blobs(tx db.Tx, ids []pacta.BlobID) (map[pacta.BlobID]*pacta.Blob, error)
+	GetOwnerForUser(tx db.Tx, userID pacta.UserID) (pacta.OwnerID, error)
+	CreateAuditLog(tx db.Tx, log *pacta.AuditLog) (pacta.AuditLogID, error)
+	User(tx db.Tx, id pacta.UserID) (*pacta.User, error)
 }
 
 type Blob interface {
@@ -74,6 +79,7 @@ func (s *Server) verifyRequest(next http.Handler) http.Handler {
 
 func (s *Server) RegisterHandlers(r chi.Router) {
 	r.Use(s.verifyRequest)
+	r.Get("/report/{analysis_id}", s.serveReport)
 	r.Get("/report/{analysis_id}/*", s.serveReport)
 }
 
@@ -103,6 +109,19 @@ func (s *Server) serveReport(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	a, err := s.db.Analysis(s.db.NoTxn(ctx), aID)
+	if err != nil {
+		if strings.HasPrefix(string(aID), "analysis") {
+			s.logger.Error("failed to load analysis", zap.String("analysis_id", string(aID)), zap.Error(err))
+			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+			return
+		} else {
+			s.logger.Info("poorly constructed analysis id", zap.String("path", string(aID)), zap.Error(err))
+			http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
+			return
+		}
+	}
+
 	subPath := strings.TrimPrefix(r.URL.Path, "/report/"+string(aID))
 	if strings.HasPrefix(subPath, "/") {
 		subPath = subPath[1:]
@@ -111,11 +130,11 @@ func (s *Server) serveReport(w http.ResponseWriter, r *http.Request) {
 		subPath = "index.html"
 	}
 
-	for _, a := range artifacts {
+	for _, aa := range artifacts {
 		// Container is just 'reports', we can ignore that.
-		b, ok := blobs[a.Blob.ID]
+		b, ok := blobs[aa.Blob.ID]
 		if !ok {
-			s.logger.Error("no blob loaded for blob ID", zap.String("analysis_artifact_id", string(a.ID)), zap.String("blob_id", string(a.Blob.ID)))
+			s.logger.Error("no blob loaded for blob ID", zap.String("analysis_artifact_id", string(a.ID)), zap.String("blob_id", string(aa.Blob.ID)))
 			continue
 		}
 		uri := string(b.BlobURI)
@@ -135,6 +154,11 @@ func (s *Server) serveReport(w http.ResponseWriter, r *http.Request) {
 			continue
 		}
 
+		if ok := s.doAuthzAndAuditLog(a, aa, w, r); !ok {
+			// Note that doAuthzAndAuditLog will have already written the response.
+			return
+		}
+
 		// Load the blob from blob storage and copy it byte-for-byte to the HTTP response.
 		r, err := s.blob.ReadBlob(ctx, uri)
 		if err != nil {
@@ -152,11 +176,76 @@ func (s *Server) serveReport(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	s.logger.Error("unknown report asset requested for analysis", zap.String("analysis_id", string(aID)), zap.String("req_path", r.URL.Path), zap.String("asset_path", subPath))
+	s.logger.Info("unknown report asset", zap.String("analysis_id", string(aID)), zap.String("req_path", r.URL.Path), zap.String("asset_path", subPath))
 	http.Error(w, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	return
 }
 
+func (s *Server) doAuthzAndAuditLog(a *pacta.Analysis, aa *pacta.AnalysisArtifact, w http.ResponseWriter, r *http.Request) bool {
+	ctx := r.Context()
+	const unauthenticatedUserID = "unauthenticated user"
+	var actorOwner *pacta.Owner
+	actorID, _ := session.UserIDFromContext(ctx)
+	if actorID == "" {
+		actorID = unauthenticatedUserID
+	} else {
+		ownerID, err := s.db.GetOwnerForUser(s.db.NoTxn(ctx), actorID)
+		if err != nil {
+			s.logger.Error("failed to get owner for user", zap.String("user_id", string(actorID)), zap.Error(err))
+			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+			return false
+		}
+		actorOwner = &pacta.Owner{ID: ownerID}
+	}
+	auditLog := &pacta.AuditLog{
+		Action:               pacta.AuditLogAction_Download,
+		ActorID:              string(actorID),
+		ActorOwner:           actorOwner,
+		PrimaryTargetType:    pacta.AuditLogTargetType_AnalysisArtifact,
+		PrimaryTargetID:      string(aa.ID),
+		PrimaryTargetOwner:   a.Owner,
+		SecondaryTargetType:  pacta.AuditLogTargetType_Analysis,
+		SecondaryTargetID:    string(a.ID),
+		SecondaryTargetOwner: a.Owner,
+	}
+	allowIfAuditLogSaves := func() bool {
+		if _, err := s.db.CreateAuditLog(s.db.NoTxn(ctx), auditLog); err != nil {
+			s.logger.Error("failed to create audit log", zap.Error(err))
+			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+			return false
+		}
+		return true
+	}
+	if aa.SharedToPublic {
+		auditLog.ActorType = pacta.AuditLogActorType_Public
+		return allowIfAuditLogSaves()
+	}
+	if actorID == unauthenticatedUserID {
+		s.logger.Info("unauthenticated user attempted to read asset", zap.String("user_id", string(actorID)))
+		http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		return false
+	}
+	if a.Owner.ID == actorOwner.ID {
+		auditLog.ActorType = pacta.AuditLogActorType_Owner
+		return allowIfAuditLogSaves()
+	}
+	if aa.AdminDebugEnabled {
+		user, err := s.db.User(s.db.NoTxn(ctx), actorID)
+		if err != nil {
+			s.logger.Error("failed to get user", zap.String("user_id", string(actorID)), zap.Error(err))
+			http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+			return false
+		}
+		if user.Admin || user.SuperAdmin {
+			auditLog.ActorType = pacta.AuditLogActorType_Admin
+			return allowIfAuditLogSaves()
+		}
+	}
+	s.logger.Info("unauthorized user attempted to read asset", zap.String("user_id", string(actorID)))
+	http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+	return false
+}
+
 func fileTypeToMIME(ft pacta.FileType) string {
 	switch ft {
 	case pacta.FileType_CSV:
diff --git a/reportsrv/reportsrv_test.go b/reportsrv/reportsrv_test.go
index e0e5a9f..54b1134 100644
--- a/reportsrv/reportsrv_test.go
+++ b/reportsrv/reportsrv_test.go
@@ -2,6 +2,7 @@ package reportsrv
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -11,29 +12,54 @@ import (
 	"github.com/RMI/pacta/blob"
 	"github.com/RMI/pacta/db"
 	"github.com/RMI/pacta/pacta"
+	"github.com/RMI/pacta/session"
 	"github.com/go-chi/chi/v5"
 	"go.uber.org/zap/zaptest"
 )
 
 func TestServeReport(t *testing.T) {
-	ctx := context.WithValue(context.Background(), chi.RouteCtxKey, &chi.Context{
-		URLParams: chi.RouteParams{
-			Keys:   []string{"analysis_id"},
-			Values: []string{"analysis.id1"},
-		},
-	})
 
 	srv, env := setup(t)
 
+	aIDStr := "analysis.id1"
+	analysisID := pacta.AnalysisID(aIDStr)
+	ownerID := pacta.OwnerID("owner.id1")
+	userID := pacta.UserID("user.id1")
+	otherUserID := pacta.UserID("user.id2")
+	adminUserID := pacta.UserID("user.id3")
+
+	env.db.users = []*pacta.User{{
+		ID: userID,
+	}, {
+		ID: otherUserID,
+	}, {
+		ID:    adminUserID,
+		Admin: true,
+	}}
+
+	env.db.userToOwner = map[pacta.UserID]pacta.OwnerID{
+		userID:      ownerID,
+		otherUserID: "other.owner.id",
+		adminUserID: "admin.owner.id",
+	}
+
+	env.db.analyses = []*pacta.Analysis{
+		&pacta.Analysis{
+			ID:    analysisID,
+			Owner: &pacta.Owner{ID: ownerID},
+		},
+	}
+
 	env.db.analysisArtifacts = []*pacta.AnalysisArtifact{
 		&pacta.AnalysisArtifact{
-			ID:         "analysisartifact.id1",
-			AnalysisID: "analysis.id1",
-			Blob:       &pacta.Blob{ID: "blob.id1"},
+			ID:                "analysisartifact.id1",
+			AnalysisID:        analysisID,
+			Blob:              &pacta.Blob{ID: "blob.id1"},
+			AdminDebugEnabled: true,
 		},
 		&pacta.AnalysisArtifact{
 			ID:         "analysisartifact.id2",
-			AnalysisID: "analysis.id1",
+			AnalysisID: analysisID,
 			Blob:       &pacta.Blob{ID: "blob.id2"},
 		},
 	}
@@ -60,36 +86,94 @@ func TestServeReport(t *testing.T) {
 		"test://reports/1111-2222-3333-4444/lib/some/package.js": jsContent,
 	}
 
-	serveReportAndCheckResponse := func(path, contentType, responseBody string) {
-		t.Run(path, func(t *testing.T) {
-			r := httptest.NewRequest(http.MethodGet, path, nil).WithContext(ctx)
+	cases := []struct {
+		asUser          pacta.UserID
+		path            string
+		wantErr         int
+		wantContentType string
+		wantRespContent string
+	}{{
+		asUser:          userID,
+		path:            "/report/" + aIDStr,
+		wantContentType: "text/html",
+		wantRespContent: htmlContent,
+	}, {
+		asUser:          userID,
+		path:            "/report/" + aIDStr + "/",
+		wantContentType: "text/html",
+		wantRespContent: htmlContent,
+	}, {
+		asUser:          userID,
+		path:            "/report/" + aIDStr + "/index.html",
+		wantContentType: "text/html",
+		wantRespContent: htmlContent,
+	}, {
+		asUser:          userID,
+		path:            "/report/" + aIDStr + "/lib/some/package.js",
+		wantContentType: "text/javascript",
+		wantRespContent: jsContent,
+	}, {
+		asUser:          "",
+		path:            "/report/" + aIDStr,
+		wantContentType: "text/html",
+		wantErr:         http.StatusUnauthorized,
+	}, {
+		asUser:          otherUserID,
+		path:            "/report/" + aIDStr,
+		wantContentType: "text/html",
+		wantErr:         http.StatusUnauthorized,
+	}, {
+		asUser:          adminUserID,
+		path:            "/report/" + aIDStr,
+		wantContentType: "text/html",
+		wantRespContent: htmlContent,
+	}, {
+		asUser:          userID,
+		path:            "/report/a-nonsense-report",
+		wantContentType: "text/html",
+		wantErr:         http.StatusNotFound,
+	}}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("case %d", i), func(t *testing.T) {
+			ctx := context.WithValue(context.Background(), chi.RouteCtxKey, &chi.Context{
+				URLParams: chi.RouteParams{
+					Keys:   []string{"analysis_id"},
+					Values: []string{"analysis.id1"},
+				},
+			})
+			if c.asUser != "" {
+				ctx = session.WithUserID(ctx, c.asUser)
+			}
+
+			r := httptest.NewRequest(http.MethodGet, c.path, nil).WithContext(ctx)
 			w := httptest.NewRecorder()
 
 			srv.serveReport(w, r)
 
 			res := w.Result()
 			// Successful response...
-			if got, want := w.Code, http.StatusOK; got != want {
-				t.Errorf("got status code %d, want %d", got, want)
+			wantCode := http.StatusOK
+			if c.wantErr != 0 {
+				wantCode = c.wantErr
+			}
+			gotCode := res.StatusCode
+			if gotCode != wantCode {
+				t.Errorf("got status code %d, want %d", gotCode, wantCode)
+			}
+			if c.wantErr != 0 {
+				return
 			}
 			// ...with the correct content-type...
-			if got, want := res.Header.Get("Content-Type"), contentType; got != want {
+			if got, want := res.Header.Get("Content-Type"), c.wantContentType; got != want {
 				t.Errorf("Content-Type = %q, want %q", got, want)
 			}
 			// ...and the correct response body.
-			if got, want := w.Body.String(), responseBody; got != want {
+			if got, want := w.Body.String(), c.wantRespContent; got != want {
 				t.Errorf("Response body = %q, want %q", got, want)
 			}
 		})
 	}
-
-	// First, request the root in a few different ways. All of then should return the /index.html file contents.
-	serveReportAndCheckResponse("/report/analysis.id1", "text/html", htmlContent)
-	serveReportAndCheckResponse("/report/analysis.id1/", "text/html", htmlContent)
-	serveReportAndCheckResponse("/report/analysis.id1/index.html", "text/html", htmlContent)
-
-	// Now, try loading an asset from the report.
-	serveReportAndCheckResponse("/report/analysis.id1/lib/some/package.js", "text/javascript", jsContent)
 }
 
 type testEnv struct {
@@ -119,10 +203,14 @@ type testDB struct {
 	// Recording inputs
 	gotAnalysisIDs []pacta.AnalysisID
 	gotBlobIDs     [][]pacta.BlobID
+	gotAuditLogs   []pacta.AuditLog
 
 	// Hardcoded outputs
+	analyses          []*pacta.Analysis
 	analysisArtifacts []*pacta.AnalysisArtifact
 	blobs             map[pacta.BlobID]*pacta.Blob
+	userToOwner       map[pacta.UserID]pacta.OwnerID
+	users             []*pacta.User
 }
 
 func (tdb *testDB) NoTxn(ctx context.Context) db.Tx {
@@ -139,6 +227,37 @@ func (tdb *testDB) Blobs(tx db.Tx, ids []pacta.BlobID) (map[pacta.BlobID]*pacta.
 	return tdb.blobs, nil
 }
 
+func (tdb *testDB) GetOwnerForUser(tx db.Tx, userID pacta.UserID) (pacta.OwnerID, error) {
+	ownerID, ok := tdb.userToOwner[userID]
+	if !ok {
+		return "", fmt.Errorf("user %q not found", userID)
+	}
+	return ownerID, nil
+}
+
+func (tdb *testDB) CreateAuditLog(tx db.Tx, log *pacta.AuditLog) (pacta.AuditLogID, error) {
+	tdb.gotAuditLogs = append(tdb.gotAuditLogs, *log)
+	return pacta.AuditLogID("auditlog.id1"), nil
+}
+
+func (tdb *testDB) User(tx db.Tx, id pacta.UserID) (*pacta.User, error) {
+	for _, u := range tdb.users {
+		if u.ID == id {
+			return u, nil
+		}
+	}
+	return nil, fmt.Errorf("user %q not found", id)
+}
+
+func (tdb *testDB) Analysis(tx db.Tx, id pacta.AnalysisID) (*pacta.Analysis, error) {
+	for _, a := range tdb.analyses {
+		if a.ID == id {
+			return a, nil
+		}
+	}
+	return nil, fmt.Errorf("analysis %q not found", id)
+}
+
 type testBlob struct {
 	// Recording input
 	gotURIs []string