What controls the visibility of Attachments on an Invoice in Supplier Portal?

Summary:

We have created a Custom "Supplier Accounts Receivable Specialist" Job Role and removed all of the data security policies for the Application Attachment Categories. However, when I log into Supplier Portal as a Supplier User and view an Invoice created by an "Internal" User, I am still able to see all Attachment Categories. What functionality "controls" the Attachments that are viewable by a Supplier User in Supplier Portal on an Invoice?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

24B

Code Snippet (add any code snippets that support your topic, if applicable):