A security layer
Each template decides whether the records it creates join partner (extranet) security, and how far that access reaches: just the record, the record and everything beneath it, or every record of that template. Partners see exactly what the template allows, automatically.