Assigning item level permissions adds user to portal permissions

Question

I have an event receiver on a task list that gets the assigned to people, and grants them 'full control' on that item. Below is the method the event receiver fires, on add and update:

public void AddFullControlUsersToItem(SPWeb subsiteWeb, SPListItem item,     List<SPFieldUserValue> assignedUsers)
    {
        try
        {
            //remove all item permissions
            while (item.RoleAssignments.Count > 0)
            {
                item.RoleAssignments.Remove(0);
                item.Update();
            }

            //add permissions to this listitem for the assigned users
            foreach (SPFieldUserValue user in assignedUsers)
            {
                // create role assignment and definition
                SPRoleAssignment assign = new SPRoleAssignment(user.User);
                SPRoleDefinition def = subsiteWeb.RoleDefinitions[DefaultSettings.S_PERMISSION_FullControl];
                assign.RoleDefinitionBindings.Add(def);

                // add user permission to subsite
                item.RoleAssignments.Add(assign);
                item.Update();
            }
        }
        catch (Exception ex)
        {
            throw new SecurityException("Intervate.CMS.Administration.Security.SecurityRepository", "AddFullControlUsersToItem", "Could not add Full control users to items", ex);
        }
    }

I have noticed that this has the side effect of adding those users directly into the site permissions, with limited access.

However when I remove this user from the item (which removes the users permissions) they stay in site permissions :| ??

So I have two questions:

1. Is there an error in the way I am assigning / removing the permissions that is causing this behavior? and
2. If there is, how should I fix this?

Answer 1

This is SharePoint functionality as designed. SharePoint need to acknowledge Limited Access on sites above the item to allow let-through permissions to the item.

By using SharePoint groups you can avoid this behaviour by doing the following:

• Create a new SharePoint Group. Assign permissions for the item to the SharePoint group. The group contains the users.
• Remove permissions from the item to the SharePoint group and remove the group.

Since the group is removed entirely from the Site Collection, the Limited Access permissions are not present.