The invention relates to an personalized access policy server (pAPS) C1 deriving dynamically granted resources with respect to user's grants and with respect to already accessed resources. It relates to a method for providing dynamically defined limited Internet access to a user's terminal client A1, wherein a portal server C2 provides a portal web site with portal information identifying the set of accessible resources, the terminal client A1 has access to said portal web site; from the portal web site a set of granted resources B3 is dynamically derived with respect to user's grants and with respect to already accessed resources by the personalized access policy server. Further it relates to a portal system, a portal server C2, a personalized access policy server (pAPS) C1, a firewall B2, and corresponding computer software products.