For the 'Annual Control Report' and the 'EC Audit Report Correspondence' exist an option to restrict the read permission to some Authorities, this is an additional restriction.
The option 'Access restricted to the following authorities (If left empty, default will apply)' is for the EC user/sender of this kind of document where she/he can restrict the read permission to only one or two (out of the 3 authorities). It is not a nominative list, it is the option to choose just one/two authorities instead of the default option.
The user in the Member State can only read it when they have the read access on the linked CCIs and when they have one of the roles selected on the correct Node.
Aside from the permission to read a document, there is also the notification. Notifications of events are sent out to all officials in charge of the Programme to which the document refers to or any user/functional mailbox that subscribed for this type of event and CCI. Receiving such notification, doesn't mean you have read access to the document. It only means you have been notified of the event.