Portfolio Managers were able to edit resource working hours, despite a message ('You don't have access to edit this record') stating they didn’t have access.

This bug has been fixed: The Portfolio Manager role no longer has calendar permissions, preventing unauthorized changes to working hours.