A signed URL proves integrity, not every permission
A download link carries a valid signature, but the file is still private to one account. A signature proves that the signed URL has not been modified according to the application's signing rules. It does not automatically express every access policy for the resource.
Decide whether the link is a bearer capability
$url = URL::temporarySignedRoute(
'reports.download', now()->addMinutes(15), ['report' => $report->id]
);
The matching route must enforce signature validation. If the product expects only the signed-in owner to download the report, require authentication and authorize the report as well. If anyone possessing the link may download it, document and protect that bearer-link behavior deliberately.
Expiry is only one limit
A signed link can be forwarded before it expires. Single-use access needs additional server-side state. Revocation after a report is removed or permissions change also requires the download handler to check current conditions.
Be careful about which query parameters are excluded from signature validation. Ignoring an authorization-relevant parameter defeats the purpose of protecting the URL's meaning.
Test an intact link, a modified report ID, an expired link, and a different authenticated user. Verify the file is not directly public on disk if the route is supposed to protect it. A perfectly validated download controller cannot protect a second unrestricted URL pointing to the same private file.