If this is a worry, the reporting tool probably shouldn't be requesting attachments directly. If it wants attachments at all, it should retrieve the statements, examine the statements and attachment sizes, and determine which subset of attachments it wants to fetch. Having some subset of statements missing because they're filtered out by the request is just going to lead to bad reporting. In fact, we might want to consider that as a general rule: *never* return attachments as part of general statement fetching, but allow them to be fetched individually as the client decides. Slightly more work for things looking to work with attachments... except not, because it will be a rare tool that really wants to include any possible attachment, and doesn't want to avoid certain very large attachments (awaiting user action or similar).