The five web roles, the scope each one carries, and the capability matrix defaulted from the permissions the portal actually enforces. Retune anything and it becomes a change request until the guard is built in code.
Personas
Customer contact
The default for a customer participant. Full participation, one sanctioned write path.
Allowed
Reach every project belonging to their parent account
Complete actions assigned to them and comment on any shared action
Upload documents
Submit an enquiry and follow its sync state
Submit closure feedback once, on their own behalf
Not allowed
Create, reassign or re-date an action
Edit the plan — the Gantt is read-only for externals at go-live
See any financial fact, internal note or assessment trail
Screens
ProjectsAction logEnquiriesFeedbackProfile
Partner contact
Machine tool builders and similar. Reaches only the projects they are named on.
Allowed
Reach projects through an explicit participation row, and nothing else
Complete actions assigned to them and comment
See partner-visible documents only
Not allowed
Reach a project through their parent account — that account is the partner's own
Submit an enquiry, closure feedback, a proposal or a statement of work
See customer-only documents
Screens
Projects (participation only)Action logProfile
Scope matrix
What each persona reads, edits and approves, and at which level. A cell changed from the built-in decision is outlined and listed above as a change request.
Persona
Read
Edit
Approve
Level
Reporting
Customer contact
Country
Own records
—
Account (customer)
Own account's projects and actions
Partner contact
Own records
Own records
—
Named participation
Projects they are named on
Global read with regional edit is Read=Organisation plus Write=Business Unit in one Dataverse security role. Country is a team, not a business unit. Region means one of Americas, North West Europe, South East Europe, APAC.
Capability matrix
Ticks come from the real table permission matrix. A cell you change is outlined and listed above as a change request. Two personas only (15 Sep 2026): Anonymous and Authenticated remain platform roles required by Power Pages for the sign-in hand-off, not personas, and "Customer contact (read only)" is retired as a persona while the web role itself stays enforced.
Capability
Customer
Partner
Project surfaces
See a project
seco_project · R
See the plan (gates & milestones)
seco_projectgate · R · Internal effort estimates excluded
See deliverables
seco_deliverable · R · Cost to deliver excluded
See project documents
seco_projectdocument · R · Visibility-filtered by each document's own sharing settings
Submit closure feedback
seco_feedback · C
See own feedback
seco_feedback · R · Own submitted row only
/actions
See the action log
seco_action · R · Internal-only actions excluded at the query
Elsewhere
Complete an assigned action
seco_action · W · Own assigned actions only
Comment on an action
seco_actioncomment · C
See the action history
seco_actionlog · R
Record portal activity
seco_portalactivity · C
Export a list as CSV or PDF
— · R · Never available to a read-only role (1 Sep 2026 decision)
/opportunities/:id/enquiry
Submit an enquiry
seco_opportunityintake · C
/enquiries
See own enquiries
seco_opportunityintake · R · Contact scope; sync error excluded
/profile
See own profile
contact · R · Self scope — no colleague directory
Edit own profile
contact · W
/profile/access
See own organisation
account · R
See own participation
seco_projectparticipant · R
See own access window
seco_externalaccess · R
/invite/:token
Open an invitation by token
seco_externalinvitation · R · Token alone; explicit column projection
Rules that apply to everyone
Rules
A web role grants nothing on its own; the (table, web role) pair and its scope grant the read.
Denials are explicit entries in the matrix, not absences — a reviewer must see the decision.
Route guards are a courtesy; the table permission is the control.
Financial tables are denied entirely rather than column-secured.
Internal-only actions, internal effort estimates and internal notes are excluded at the query, never in the component.
Access ends automatically when participation lapses or the contact leaves their organisation.
Read-only access grants no export of any kind: no CSV, no PDF, no data extract (1 Sep 2026 decision).
Open questions
What the security workshops have not settled. Anyone may record a response; changing the wording of a question needs edit configuration.
1.
How do Seco-internal staff authenticate to the Portal — the Sandvik tenant directly, or a portal contact record mirrored from the internal directory?
2.
Can a partner ever reach a project through their parent account, or is named participation the only path forever?
3.
Who approves an extension of an external access window once participation has lapsed — the Seco lead, or the project's governance owner?
4.
Settled 1 Sep 2026 — dormancy is signalled from Platform 2 and warns at the 60-day boundary; access lapses after 60 days of inactivity, and deactivation is reviewed rather than automatic.
5.
Settled 1 Sep 2026 — export is itself a privilege: a read-only contact gets no export of any kind, in any format (BR-084).