flectra/addons/hr_timesheet/security/hr_timesheet_security.xml

<?xml version="1.0" encoding="UTF-8"?>
<flectra>

    <data noupdate="1">

        <record id="group_hr_timesheet_user" model="res.groups">
            <field name="name">User</field>
            <field name="category_id" ref="base.module_category_hr_timesheet"/>
            <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
            <field name="users" eval="[(4, ref('base.user_root'))]"/>
        </record>

        <record id="group_timesheet_manager" model="res.groups">
            <field name="name">Manager</field>
            <field name="category_id" ref="base.module_category_hr_timesheet"/>
            <field name="implied_ids" eval="[(4, ref('group_hr_timesheet_user')), (4, ref('hr.group_hr_user'))]"/>
            <field name="users" eval="[(4, ref('base.user_root'))]"/>
        </record>

        <record id="base.default_user" model="res.users">
            <field name="groups_id" eval="[(4,ref('group_hr_timesheet_user'))]"/>
        </record>

    </data>

    <data noupdate="0">
        <!-- This rule is in noupdate mode because it can be modify by other advanced modules -->
        <record id="timesheet_line_rule_user" model="ir.rule">
            <field name="name">account.analytic.line.timesheet.user</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[('user_id', '=', user.id), ('project_id', '!=', False)]</field>
            <field name="groups" eval="[(4, ref('group_hr_timesheet_user'))]"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_unlink" eval="1"/>
            <field name="perm_read" eval="0"/>
        </record>

    </data>

    <data noupdate="1">

        <record id="timesheet_line_rule_manager" model="ir.rule">
            <field name="name">account.analytic.line.timesheet.manager</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[('project_id', '!=', False)]</field>
            <field name="groups" eval="[(4, ref('group_timesheet_manager'))]"/>
            <field name="perm_create" eval="1"/>
            <field name="perm_write" eval="1"/>
            <field name="perm_unlink" eval="1"/>
            <field name="perm_read" eval="0"/>
        </record>

        <record id="timesheet_rule_portal" model="ir.rule">
            <field name="name">Project/Task Timesheets: frontend access</field>
            <field name="model_id" ref="analytic.model_account_analytic_line"/>
            <field name="domain_force">[
                '|',
                    '&amp;',
                        ('task_id.project_id.privacy_visibility', '=', 'portal'),
                        ('task_id.project_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
                    '&amp;',
                        ('task_id.project_id.privacy_visibility', '=', 'portal'),
                        ('task_id.message_partner_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
            ]</field>
            <field name="groups" eval="[(4, ref('base.group_portal'))]"/>
        </record>

    </data>

</flectra>