I have created a simple workround for this...
Bearing in mind CSP is all but glorified ASP, I have put the reports in numbered folders and then created an access user database containing their username, password and access level. When they first go to the reports, they only see the reports in the default folder but when logged in, the CSP (ASP) file uses their access level to display the list of reports in the relevant folders. It also changes the default report to show more detail for dirctors etc.
The user database and the CSP are located on the NT report server so security can be set up reasonably.
You can use the SQL Query:
SELECT SI_ID, SI_NAME FROM CI_INFOOBJECTS WHERE SI_PARENTID = 123 AND NOT(SI_OBTYPE = 1 OR SI_OBTYPE = 18)
to give you the last successfully run version of reports in the folder whose parent ID is 123 (in this example). You can get the ID from checking the properties of the links to the folders from the Crystal Management Console.
I hope this helps.
If you need more info, let me know.