diff --git a/application/Espo/Controllers/Portal.php b/application/Espo/Controllers/Portal.php
new file mode 100644
index 0000000000..7a77cc1231
--- /dev/null
+++ b/application/Espo/Controllers/Portal.php
@@ -0,0 +1,35 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+class Portal extends \Espo\Core\Controllers\Record
+{
+
+}
diff --git a/application/Espo/Controllers/PortalRole.php b/application/Espo/Controllers/PortalRole.php
new file mode 100644
index 0000000000..87976ce77f
--- /dev/null
+++ b/application/Espo/Controllers/PortalRole.php
@@ -0,0 +1,34 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Controllers;
+
+class PortalRole extends \Espo\Core\Controllers\Record
+{
+}
diff --git a/application/Espo/Core/Acl/Table.php b/application/Espo/Core/Acl/Table.php
index 77a9df01db..7a2fcdaabb 100644
--- a/application/Espo/Core/Acl/Table.php
+++ b/application/Espo/Core/Acl/Table.php
@@ -186,7 +186,9 @@ class Table
             }
 
             $aclTable = $this->mergeTableList($aclTableList);
-            $fieldTable = $this->mergefieldTableList($fieldTableList);
+            $fieldTable = $this->mergeFieldTableList($fieldTableList);
+
+            $this->applyDefault($aclTable, $fieldTable);
 
             foreach ($this->getScopeList() as $scope) {
                 if ($this->metadata->get('scopes.' . $scope . '.disabled')) {
@@ -195,7 +197,7 @@ class Table
                 }
             }
 
-            $this->applySolid($aclTable, $fieldTable);
+            $this->applyMandatory($aclTable, $fieldTable);
         } else {
             $aclTable = (object) [];
             foreach ($this->getScopeList() as $scope) {
@@ -227,8 +229,15 @@ class Table
         $this->fillFieldTableQuickAccess();
 
         if (!$this->user->isAdmin()) {
-            $this->data->assignmentPermission = $this->mergeValueList($assignmentPermissionList, $this->metadata->get('app.acl.valueDefaults.assignmentPermission', 'all'));
-            $this->data->userPermission = $this->mergeValueList($userPermissionList, $this->metadata->get('app.acl.valueDefaults.userPermission', 'no'));
+            $this->data->assignmentPermission = $this->mergeValueList($assignmentPermissionList, $this->metadata->get('app.acl.default.assignmentPermission', 'all'));
+            $this->data->userPermission = $this->mergeValueList($userPermissionList, $this->metadata->get('app.acl.default.userPermission', 'no'));
+
+            if ($this->metadata->get('app.acl.mandatory.assignmentPermission')) {
+                $this->data->assignmentPermission = $this->metadata->get('app.acl.mandatory.assignmentPermission');
+            }
+            if ($this->metadata->get('app.acl.mandatory.userPermission')) {
+                $this->data->userPermission = $this->metadata->get('app.acl.mandatory.userPermission');
+            }
         } else {
             $this->data->assignmentPermission = 'all';
             $this->data->userPermission = 'all';
@@ -348,7 +357,7 @@ class Table
         $this->data->fieldTableQuickAccess = $fieldTableQuickAccess;
     }
 
-    protected function applySolid(&$table, &$fieldTable)
+    protected function applyDefault(&$table, &$fieldTable)
     {
         if (!$this->metadata) {
             return;
@@ -358,7 +367,64 @@ class Table
             return;
         }
 
-        $data = $this->metadata->get('app.acl.solid', array());
+        $data = $this->metadata->get('app.acl.default.scopeLevel', array());
+
+        foreach ($data as $scope => $item) {
+            if (isset($table->$scope)) continue;
+            $value = $item;
+            if (is_array($item)) {
+                $value = (object) $item;
+            }
+            $table->$scope = $value;
+        }
+
+        $fieldData = $this->metadata->get('app.acl.default.fieldLevel', array());
+
+        foreach ($fieldData as $scope => $s) {
+            foreach ($s as $field => $f) {
+                if (!isset($fieldTable->$scope)) {
+                    $fieldTable->$scope = (object) [];
+                }
+                if (isset($fieldTable->$scope->$field)) continue;
+                $fieldTable->$scope->$field = (object) [];
+                foreach ($this->fieldActionList as $action) {
+                    $level = 'no';
+                    if (isset($f[$action])) {
+                        $level = $f[$action];
+                    }
+                    $fieldTable->$scope->$field->$action = $level;
+                }
+            }
+        }
+
+        foreach ($this->getScopeWithAclList() as $scope) {
+            if (!isset($table->$scope)) {
+                $aclType = $this->metadata->get('scopes.' . $scope . '.acl');
+                if ($aclType === true) {
+                    $aclType = 'recordAllTeamOwnNo';
+                }
+                if (!empty($aclType)) {
+                    $defaultValue = $this->metadata->get('app.acl.scopeLevelTypesDefaults.' . $aclType, true);
+                    if (is_array($defaultValue)) {
+                        $defaultValue = (object) $defaultValue;
+                    }
+                    $table->$scope = $defaultValue;
+                }
+            }
+        }
+    }
+
+    protected function applyMandatory(&$table, &$fieldTable)
+    {
+        if (!$this->metadata) {
+            return;
+        }
+
+        if ($this->user->isAdmin()) {
+            return;
+        }
+
+        $data = $this->metadata->get('app.acl.mandatory.scopeLevel', array());
 
         foreach ($data as $scope => $item) {
             $value = $item;
@@ -367,6 +433,24 @@ class Table
             }
             $table->$scope = $value;
         }
+
+        $fieldData = $this->metadata->get('app.acl.mandatory.fieldLevel', array());
+
+        foreach ($fieldData as $scope => $s) {
+            if (!isset($fieldTable->$scope)) {
+                $fieldTable->$scope = (object) [];
+            }
+            foreach ($s as $field => $f) {
+                $fieldTable->$scope->$field = (object) [];
+                foreach ($this->fieldActionList as $action) {
+                    $level = 'no';
+                    if (isset($f[$action])) {
+                        $level = $f[$action];
+                    }
+                    $fieldTable->$scope->$field->$action = $level;
+                }
+            }
+        }
     }
 
     private function mergeValueList(array $list, $defaultValue)
@@ -462,25 +546,10 @@ class Table
             }
         }
 
-        foreach ($scopeList as $scope) {
-        	if (!isset($data->$scope)) {
-        		$aclType = $this->metadata->get('scopes.' . $scope . '.acl');
-                if ($aclType === true) {
-                    $aclType = 'recordAllTeamOwnNo';
-                }
-        		if (!empty($aclType)) {
-                    $defaultValue = $this->metadata->get('app.acl.defaults.' . $aclType, true);
-                    if (is_array($defaultValue)) {
-                        $defaultValue = (object) $defaultValue;
-                    }
-	        		$data->$scope = $defaultValue;
-        		}
-        	}
-        }
         return $data;
     }
 
-    private function mergefieldTableList(array $tableList)
+    private function mergeFieldTableList(array $tableList)
     {
         $data = (object) [];
         $scopeList = $this->getScopeWithAclList();
diff --git a/application/Espo/Entities/Portal.php b/application/Espo/Entities/Portal.php
new file mode 100644
index 0000000000..5449c7cbb1
--- /dev/null
+++ b/application/Espo/Entities/Portal.php
@@ -0,0 +1,35 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Entities;
+
+class Portal extends \Espo\Core\ORM\Entity
+{
+
+}
diff --git a/application/Espo/Entities/PortalRole.php b/application/Espo/Entities/PortalRole.php
new file mode 100644
index 0000000000..1f7bb51281
--- /dev/null
+++ b/application/Espo/Entities/PortalRole.php
@@ -0,0 +1,35 @@
+<?php
+/************************************************************************
+ * This file is part of EspoCRM.
+ *
+ * EspoCRM - Open Source CRM application.
+ * Copyright (C) 2014-2015 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
+ * Website: http://www.espocrm.com
+ *
+ * EspoCRM is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * EspoCRM is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with EspoCRM. If not, see http://www.gnu.org/licenses/.
+ *
+ * The interactive user interfaces in modified source and object code versions
+ * of this program must display Appropriate Legal Notices, as required under
+ * Section 5 of the GNU General Public License version 3.
+ *
+ * In accordance with Section 7(b) of the GNU General Public License version 3,
+ * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
+ ************************************************************************/
+
+namespace Espo\Entities;
+
+class PortalRole extends \Espo\Core\ORM\Entity
+{
+
+}
diff --git a/application/Espo/Entities/Role.php b/application/Espo/Entities/Role.php
index 12fa918ebe..339e995ed1 100644
--- a/application/Espo/Entities/Role.php
+++ b/application/Espo/Entities/Role.php
@@ -25,12 +25,11 @@
  *
  * In accordance with Section 7(b) of the GNU General Public License version 3,
  * these Appropriate Legal Notices must retain the display of the "EspoCRM" word.
- ************************************************************************/ 
+ ************************************************************************/
 
 namespace Espo\Entities;
 
 class Role extends \Espo\Core\ORM\Entity
 {
- 
 
 }
diff --git a/application/Espo/Modules/Crm/Resources/metadata/app/acl.json b/application/Espo/Modules/Crm/Resources/metadata/app/acl.json
index 09a9b77d74..5124924cb2 100644
--- a/application/Espo/Modules/Crm/Resources/metadata/app/acl.json
+++ b/application/Espo/Modules/Crm/Resources/metadata/app/acl.json
@@ -1,8 +1,10 @@
 {
-    "solid": {
-        "MassEmail": "Campaign",
-        "CampaignLogRecord": "Campaign",
-        "CampaignTrackingUrl": "Campaign",
-        "EmailQueueItem": false
+    "mandatory": {
+        "scopeLevel": {
+            "MassEmail": "Campaign",
+            "CampaignLogRecord": "Campaign",
+            "CampaignTrackingUrl": "Campaign",
+            "EmailQueueItem": false
+        }
     }
 }
\ No newline at end of file
diff --git a/application/Espo/Resources/i18n/en_US/Portal.json b/application/Espo/Resources/i18n/en_US/Portal.json
index 22e9fb3134..5e3640eef4 100644
--- a/application/Espo/Resources/i18n/en_US/Portal.json
+++ b/application/Espo/Resources/i18n/en_US/Portal.json
@@ -4,7 +4,8 @@
         "logo": "Logo",
         "url": "URL",
         "portalRoles": "Roles",
-        "isActive": "Is Active"
+        "isActive": "Is Active",
+        "isDefault": "Is Default"
     },
     "links": {
         "users": "Users",
diff --git a/application/Espo/Resources/layouts/Portal/detail.json b/application/Espo/Resources/layouts/Portal/detail.json
new file mode 100644
index 0000000000..0e21b33431
--- /dev/null
+++ b/application/Espo/Resources/layouts/Portal/detail.json
@@ -0,0 +1,8 @@
+[
+    {
+        "rows": [
+            [{"name": "name"},{"name": "isActive"}],
+            [{"name": "url"},{"name": "isDefault"}]
+        ]
+    }
+]
\ No newline at end of file
diff --git a/application/Espo/Resources/layouts/Portal/relationships.json b/application/Espo/Resources/layouts/Portal/relationships.json
new file mode 100644
index 0000000000..ef645c0425
--- /dev/null
+++ b/application/Espo/Resources/layouts/Portal/relationships.json
@@ -0,0 +1,3 @@
+[
+    "users"
+]
\ No newline at end of file
diff --git a/application/Espo/Resources/metadata/app/acl.json b/application/Espo/Resources/metadata/app/acl.json
index a679eb5f2f..b81174d991 100644
--- a/application/Espo/Resources/metadata/app/acl.json
+++ b/application/Espo/Resources/metadata/app/acl.json
@@ -1,48 +1,66 @@
 {
-    "solid": {
-        "User": {
-            "read": "all",
-            "edit": "no",
-            "delete": "no"
+    "mandatory": {
+        "scopeLevel": {
+            "User": {
+                "read": "all",
+                "edit": "no",
+                "delete": "no"
+            },
+            "Team": {
+                "read": "all",
+                "edit": "no",
+                "delete": "no"
+            },
+            "Note": {
+                "read": "own",
+                "edit": "own",
+                "delete": "own"
+            },
+            "Portal": {
+                "read": "all",
+                "edit": "no",
+                "delete": "no"
+            },
+            "EmailAddress": {
+                "read": "no",
+                "edit": "no",
+                "delete": "no"
+            },
+            "Attachment": {
+                "read": "own",
+                "edit": "own",
+                "delete": "own"
+            },
+            "PhoneNumber": {
+                "read": "no",
+                "edit": "no",
+                "delete": "no"
+            },
+            "EmailAccount": {
+                "read": "own",
+                "edit": "own",
+                "delete": "own"
+            },
+            "EmailFilter": {
+                "read": "own",
+                "edit": "own",
+                "delete": "own"
+            },
+            "Role": false,
+            "PortalRole": false
         },
-        "Team": {
-            "read": "all",
-            "edit": "no",
-            "delete": "no"
-        },
-        "Note": {
-            "read": "own",
-            "edit": "own",
-            "delete": "own"
-        },
-        "EmailAddress": {
-            "read": "no",
-            "edit": "no",
-            "delete": "no"
-        },
-        "Attachment": {
-            "read": "own",
-            "edit": "own",
-            "delete": "own"
-        },
-        "PhoneNumber": {
-            "read": "no",
-            "edit": "no",
-            "delete": "no"
-        },
-        "EmailAccount": {
-            "read": "own",
-            "edit": "own",
-            "delete": "own"
-        },
-        "EmailFilter": {
-            "read": "own",
-            "edit": "own",
-            "delete": "own"
-        },
-        "Role": false
+        "fieldLevel": {
+        }
     },
-    "defaults": {
+    "default": {
+        "scopeLevel": {
+        },
+        "fieldLevel": {
+        },
+        "assignmentPermission": "all",
+        "userPermission": "no"
+    },
+    "scopeLevelTypesDefaults": {
         "boolean": true,
         "recordAllTeamOwnNo": {
             "read": "all",
@@ -64,9 +82,5 @@
             "edit": "all",
             "delete": "no"
         }
-    },
-    "valueDefaults": {
-        "assignmentPermission": "all",
-        "userPermission": "no"
     }
 }
diff --git a/application/Espo/Resources/metadata/clientDefs/Portal.json b/application/Espo/Resources/metadata/clientDefs/Portal.json
new file mode 100644
index 0000000000..eb8ec9625e
--- /dev/null
+++ b/application/Espo/Resources/metadata/clientDefs/Portal.json
@@ -0,0 +1,12 @@
+{
+   "controller": "controllers/record",
+   "relationshipPanels": {
+      "users": {
+         "create": true,
+         "rowActionsView": "views/record/row-actions/relationship-unlink-only",
+         "layout": "listForTeam"
+      }
+   },
+   "recordViews": {
+   }
+}
diff --git a/application/Espo/Resources/metadata/entityDefs/Portal.json b/application/Espo/Resources/metadata/entityDefs/Portal.json
index 19488869e3..d98bfe3aaa 100644
--- a/application/Espo/Resources/metadata/entityDefs/Portal.json
+++ b/application/Espo/Resources/metadata/entityDefs/Portal.json
@@ -9,7 +9,7 @@
             "type": "image"
         },
         "url": {
-            "type": "varchar",
+            "type": "url",
             "notStorable": true,
             "readOnly": true
         },
@@ -17,6 +17,11 @@
             "type": "bool",
             "default": true
         },
+        "isDefault": {
+            "type": "bool",
+            "default": false,
+            "notStorable": true
+        },
         "portalRoles": {
             "type": "linkMultiple"
         },
diff --git a/frontend/client/res/templates/role/table.tpl b/frontend/client/res/templates/role/table.tpl
index 79e1977cda..32f4971a4a 100644
--- a/frontend/client/res/templates/role/table.tpl
+++ b/frontend/client/res/templates/role/table.tpl
@@ -35,7 +35,7 @@
     </div>
 </div>
 
-{{#if fieldTableDataList.length}}
+{{#if hasFieldLevelData}}
 <div class="panel panel-default">
     <div class="panel-heading">
         <h4 class="panel-title">{{translate 'Field Level' scope='Role'}}</h4>
diff --git a/frontend/client/src/views/role/record/table.js b/frontend/client/src/views/role/record/table.js
index 600f0810c9..898d9fd8df 100644
--- a/frontend/client/src/views/role/record/table.js
+++ b/frontend/client/src/views/role/record/table.js
@@ -76,6 +76,16 @@ Espo.define('views/role/record/table', 'view', function (Dep) {
 
             data.tableDataList = this.getTableDataList();
             data.fieldTableDataList = this.fieldTableDataList;
+
+            var hasFieldLevelData = false;
+            this.fieldTableDataList.forEach(function (d) {
+                if (d.list.length) {
+                    hasFieldLevelData = true;
+                    return;
+                }
+            }, this);
+            data.hasFieldLevelData = hasFieldLevelData;
+
             return data;
         },
 
@@ -203,10 +213,13 @@ Espo.define('views/role/record/table', 'view', function (Dep) {
                 if (!d.entity) return;
 
                 if (!(scope in this.acl.fieldData)) {
-                    this.fieldTableDataList.push({
-                        name: scope,
-                        list: []
-                    });
+                    if (this.mode === 'edit') {
+                        this.fieldTableDataList.push({
+                            name: scope,
+                            list: []
+                        });
+                        return;
+                    }
                     return;
                 };
                 var scopeData = this.acl.fieldData[scope];
@@ -227,6 +240,9 @@ Espo.define('views/role/record/table', 'view', function (Dep) {
                         })
                     }, this);
 
+                    if (this.mode === 'detail') {
+                        if (!list.length) return;
+                    }
                     fieldDataList.push({
                         name: field,
                         list: list