Portal permission sets allow you to decide which application components and data portal users can access and perform actions in, through a portal. Various profiles can be customized and assigned to different portal users, giving the organization full autonomy over access control and data security.

1. Module Level - Permission to access a Creator application's components.
   
1. By default, a permission set titled Customer exists in all applications upon creation. When portal users are initially being added, they are assigned to this permission set and can be reassigned if required. This set gives the portal user permission to access forms, view the data added by all users (records) in the reports, and access pages.
2. You can also configure customized permissions, which enables the portal user to perform actions such as accessing, viewing, editing, deleting records, and much more.
   
2. Field Level - A set of Field Permissions is also available, which decides the read and edit access of each field present in your form.

1. Portal Permission to Access Report and Page - Say you've a construction company and have developed ties with a major supplier for different construction materials. You maintain the warehouse stocks and their movement in a form Warehouse Stocks and display their metrics in a dashboard. A portal will let the supplier (portal user) into your application and let them access components according to the assigned portal permission set. To achieve this, permission to access the form's report All Warehouse Stocks and the Dashboard, and not any other components, should be assigned to the supplier when they are added to the portal.

2. Field Permissions with Restriction to Access Data-Sensitive Fields through Portal - Say you've built an Event Management application. While participants fill out a Join Event form, they are required to fill an email address field for which PII (data privacy) is enabled. By default, this field's values are not displayed in the Event Participants report for users other than the admins and super admin of the application. Say the vendor (portal user) who is sponsoring the event wants to contact those participants using the entered email address directly to hand out goodies. In this case, a permission set that is configured to Show the PII-enabled field's data is assigned to the vendor. The field permission for the Participant Name and Email field will be set to only Visibility (records can be accessed but not edited) while all other boxes are unchecked.

In the Settings tab of the Edit mode of the application, Portal User Permissions is situated under the Permissions section.

3.3. Sections in a Portal User Permission Set

1. Security Permissions - Set of rules that focus on handling sensitive data stored within records.
2. General Permissions - Set of rules that focus on handling the access to application components and related actions.

1. Show - When this is chosen, viewing PII/ePHI fields (Visibility) is allowed by default, which can be revoked if necessary. You can allow editing of the necessary PII/ePHI fields from the Field Permissions popup.
2. Hide - When this is chosen, the PII/ePHI fields will be disabled in Field Permissions popup and cannot be viewed/edited by users added to an application. This option therefore hides the fields in the form and report.

4. Points to Note