Permissions

A portal must check access to the record, not just the page

Signing in does not mean a person may open every record in the application.