The attached document goes through the implications of setting up role-based access when using the Connect Portal. It also describes a sample scenario and the permissions associated with it.