GOLEM/golem_base/security/golem_security.xml

<?xml version="1.0" encoding="utf-8"?>

<!--
Copyright 2017 Fabien Bourgeois <fabien@yaltik.com>

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
-->

<odoo>
  <data noupdate="0">
    <!-- Groups -->
    <record id="group_golem_user" model="res.groups">
      <field name="name">GOLEM user</field>
      <field name="category_id"
        ref="base.module_category_golem"/>
      <field name="implied_ids"
        eval="[(4,
        [ref('base.group_user'),
        ref('base.group_partner_manager'),
        ref('account.group_account_invoice')])]"/>
    </record>
    <record id="group_golem_manager" model="res.groups">
      <field name="name">GOLEM Manager</field>
      <field name="category_id" ref="base.module_category_golem"/>
      <field name="implied_ids" eval="[(4, ref('group_golem_user'))]"/>
      <field name="users" eval="[(4, ref('base.user_root'))]"/>
    </record>
  </data>
  <!-- Adapt base security access -->
  <record id="ir_filters_golem_manager_all_rights_rule" model="ir.rule">
    <field name="name">ir.filters.golem.manager.all.rights</field>
    <field name="model_id" ref="base.model_ir_filters"/>
    <field name="domain_force">[(1, '=', 1)]</field>
    <field name="groups" eval="[(4, ref('golem_base.group_golem_manager'))]"/>
    <field name="perm_read" eval="True"/>
    <field name="perm_write" eval="True"/>
    <field name="perm_create" eval="True"/>
    <field name="perm_unlink" eval="True"/>
  </record>
</odoo>