1. A method comprising: controlling access rights to dynamically instantiated portal applications in a portal environment, wherein new instances of a portal application and respective access control information on resources used in the instantiated portal application are generated dynamically from an automated programmed mechanism, and wherein a user-application role mapping is demanded for the instantiated portal application by a respective runtime access control function implemented at the portal environment, the controlling including: assigning an individual user-to-application role mapping to a respective individual one of the generated instances of the portal application, wherein for each incoming user request to one of the generated instances the runtime access control function checks a target application instance identifier which identifies an individual application instance desired to be addressed by the incoming request; and granting access rights to incoming user requests according to application roles as they are defined for the target application instance, wherein the access rights are granted based only on the application roles as they are defined for the target application instance.