flectra/addons/hr_attendance/security/hr_attendance_security.xml

<?xml version="1.0" encoding="utf-8"?>
<flectra>

    <record id="group_hr_attendance_user" model="res.groups">
        <field name="name">Officer</field>
        <field name="category_id" ref="base.module_category_hr_attendance"/>
        <field name="implied_ids" eval="[(4, ref('hr.group_hr_user'))]"/>
    </record>

    <record id="group_hr_attendance_manager" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="base.module_category_hr_attendance"/>
        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance_user'))]"/>
        <field name="users" eval="[(4, ref('base.user_root'))]"/>
    </record>

    <record id="group_hr_attendance" model="res.groups">
        <field name="name">Manual Attendance</field>
        <field name="category_id" ref="base.module_category_hr_attendance"/>
        <field name="comment">The user will gain access to the human resources attendance menu, enabling him to manage his own attendance.</field>
    </record>

    <record id="base.default_user" model="res.users">
        <field name="groups_id" eval="[(4,ref('hr_attendance.group_hr_attendance_manager'))]"/>
    </record>

    <record id="hr_attendance.group_hr_attendance_manager" model="res.groups">
        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance'))]"/>
    </record>

    <record id="hr_attendance.group_hr_attendance_user" model="res.groups">
        <field name="implied_ids" eval="[(4, ref('hr_attendance.group_hr_attendance'))]"/>
    </record>

    <record id="group_hr_attendance_use_pin" model="res.groups">
        <field name="name">Enable PIN use</field>
        <field name="category_id" ref="base.module_category_hidden"/>
        <field name="comment">The user will have to enter his PIN to check in and out manually at the company screen.</field>
    </record>

    <data noupdate="1">   

        <record id="hr_attendance_rule_attendance_manager" model="ir.rule">
            <field name="name">attendance officer: full access</field>
            <field name="model_id" ref="model_hr_attendance"/>
            <field name="domain_force">[(1,'=',1)]</field>
            <field name="groups" eval="[(4,ref('hr_attendance.group_hr_attendance_user'))]"/>
        </record>

        <record id="hr_attendance_rule_attendance_employee" model="ir.rule">
            <field name="name">user: modify own attendance only</field>
            <field name="model_id" ref="model_hr_attendance"/>
            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
            <field name="perm_read" eval="0"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_unlink" eval="0"/>
            <field name="groups" eval="[(4,ref('base.group_user'))]"/>
        </record>

    </data>
</flectra>