Define record permissions for case attachments

Hi community,

I've got a business case where we need to define record permissions for the attachments of cases.

Employees and portal users both have access to the case object but I need to set restrictions on the filecase object

Basicaly the business case is:

a) if a portal user adds a file, portal and all employees have access to the file

b) if an employee adds a file only employees have access to the file

I tried setting up the record permissions on the CaseFile object but am getting the error:

"Object reference not set to an instance of an object"

when I try to apply the record permissions.

As anyone had the same issue and have any idea on how to get around it?

Thanks,

Luis