Andrew, you restrict access to the bookmarks via Portal bookmark manager, by granting/denying access, using 3 tiers of access: 1) default for the bookmark, user's group membership, specific user. So, if for example you wanted to deny users from access Payroll bookmarks, you would set the default to 'Deny', then grant access either to the group you have defined for Payroll, or to specific users.