See this page: http://confluence.atlassian.com/pages/viewpage.action?pageId=9742

In the code sample for the portlet module descriptor, it says this:

<!-- the permissions required to *add* this portlet
(optional - not often required) -->
<permission>assignable</permission>

But in the paragraph following that code sample, it says this about permissions:

The Assignable permission is required for users to view this portlet.

It then links to a list of available permissions to use, which says this:

For certain JIRA plugins (e.g. Portlets), you can specify permissions required to use the plugin.

So we have 'add' which is correct, 'view' which is incorrect, and 'use' which is ambiguous. It should probably be made more clear as to what exactly the <permission> tag does for your portlet - it specifies the permission required to be able to add the portlet to your dashboard.