We have a custom application where the attachment paperclip from the portal and the comments section are visible if you are logged in as admin. The attachment paperclip and the comments section are hidden when you log in as the user who actually submitted the entry.
Assuming you're using one of the OOB pages (e.g form, standard_ticket, ticket) then these respect ACLs. The user will need to pass the necessary ACL for the record and the field (e.g .comments) in order to add a comment
