APM portal mode and On Demand Certificate Authentication

If we step back a little, could you please clarify your definitions of full portal and portal access? Would you consider full portal where you create portal resources and add those and a webtop to a resource assignment? Would you consider portal access where you define the portal resource in the webtop itself and just apply that to the resource assignment?