Ideally, clients will log their TSM activities - which the security team might want to insist upon.
Architecturally, TSM offers the REPORTRETRIEVE server option. Beware that it can be expensive in terms of TSM db space and added db activity. Richard Sims