enterprise-addons/hr_appraisal/security/hr_appraisal_security.xml

<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <record model="res.groups.privilege" id="res_groups_privilege_appraisals">
        <field name="name">Appraisals</field>
        <field name="category_id" ref="base.module_category_human_resources"/>
    </record>

    <record id="hr_appraisal.group_hr_appraisal_user" model="res.groups">
        <field name="name">Officer: Access all appraisals</field>
        <field name="sequence">10</field>
        <field name="privilege_id" ref="res_groups_privilege_appraisals"/>
        <field name="implied_ids" eval="[(4, ref('hr.group_hr_user'))]"/>
    </record>

    <record id="hr_appraisal.group_hr_appraisal_manager" model="res.groups">
        <field name="name">Administrator</field>
        <field name="sequence">20</field>
        <field name="privilege_id" ref="res_groups_privilege_appraisals"/>
        <field name="implied_ids" eval="[(4, ref('hr_appraisal.group_hr_appraisal_user'))]"/>
        <field name="user_ids" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
    </record>

    <data noupdate="1">
    <record id="hr_appraisal_campaign_responsible" model="ir.rule">
        <field name="name">Appraisal Campaign wizard Responsible</field>
        <field name="model_id" ref="model_hr_appraisal_campaign_wizard"/>
        <field name="domain_force">[
            '|',
            ('employee_ids', '=', False),
            ('employee_ids', 'child_of', user.employee_ids.ids)
        ]</field>
        <field name="perm_read" eval="True"/>
        <field name="perm_create" eval="True"/>
        <field name="perm_write" eval="True"/>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <record id="hr_appraisal_campaign_wizard_manager" model="ir.rule">
        <field name="name">Admin: access appraisals campaign</field>
        <field name="model_id" ref="model_hr_appraisal_campaign_wizard"/>
        <field name="domain_force">[
            (1, '=', 1)
        ]</field>
        <field name="perm_read" eval="True"/>
        <field name="perm_create" eval="True"/>
        <field name="perm_write" eval="True"/>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('hr_appraisal.group_hr_appraisal_user'))]"/>
    </record>

    <record id="hr_appraisal_all_rule" model="ir.rule">
        <field name="name">All Appraisal</field>
        <field name="model_id" ref="model_hr_appraisal"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('hr_appraisal.group_hr_appraisal_user'))]"/>
    </record>

    <record id="hr_appraisal_emp_rule" model="ir.rule">
        <field name="name">Employee Appraisal</field>
        <field name="model_id" ref="model_hr_appraisal"/>
        <field name="domain_force">[
            '|',
            '|',
            ('employee_id.user_id', '=', user.id),
            ('manager_ids', 'in', user.employee_ids.ids),
            ('employee_id', 'child_of', user.employee_ids.ids)
        ]</field>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <record id="hr_appraisal_emp_rule_delete_new" model="ir.rule">
        <field name="name">Employee Appraisal: delete new</field>
        <field name="model_id" ref="model_hr_appraisal"/>
        <field name="domain_force">[
            ('state', '=', '1_new'),
            '|',
            '|',
            ('employee_id.user_id', '=', user.id),
            ('manager_ids', 'in', user.employee_ids.ids),
            ('employee_id', 'child_of', user.employee_ids.ids)
        ]</field>
        <field name="perm_unlink" eval="True"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <record id="hr_appraisal_rule_base_user" model="ir.rule">
        <field name="name">Employee Appraisal: read todo</field>
        <field name="model_id" ref="model_hr_appraisal"/>
        <field name="domain_force">[
            '|',
            ('employee_id.user_id', '=', user.id),
            ('manager_ids.user_id', 'in', user.ids),
        ]</field>
        <field name="perm_create" eval="False"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <!-- Multi - Company Rules -->
    <record model="ir.rule" id="hr_appraisal_comp_rule">
        <field name="name">Appraisal multi-company</field>
        <field name="model_id" ref="model_hr_appraisal"/>
        <field name="domain_force">[('company_id', 'in', company_ids + [False])]</field>
    </record>

    <record model="ir.rule" id="hr_appraisal_note_comp_rule">
        <field name="name">Appraisal Plan multi-company</field>
        <field name="model_id" ref="model_hr_appraisal_note"/>
        <field name="domain_force">[('company_id', 'in', company_ids + [False])]</field>
    </record>

    <record model="ir.rule" id="hr_appraisal_template_comp_rule">
        <field name="name">Appraisal Template multi-company</field>
        <field name="model_id" ref="model_hr_appraisal_template"/>
        <field name="domain_force">[('company_id', 'in', company_ids  + [False])]</field>
    </record>

    <record id="hr_appraisal_goal_company_rule" model="ir.rule">
        <field name="name">Appraisal Goal multi-company</field>
        <field name="model_id" ref="model_hr_appraisal_goal"/>
        <field name="domain_force">[('company_id', 'in', company_ids + [False])]</field>
    </record>

    <record id="hr_appraisal_goal_all" model="ir.rule">
        <field name="name">Appraisal: An appraisal manager can see all goals</field>
        <field name="model_id" ref="model_hr_appraisal_goal"/>
        <field name="domain_force">[(1, '=', 1)]</field>
        <field name="groups" eval="[(4, ref('hr_appraisal.group_hr_appraisal_user'))]"/>
    </record>

    <record id="hr_appraisal_goal_own_create" model="ir.rule">
        <field name="name">Appraisal: An employee can create his own goals or his subordinates'</field>
        <field name="model_id" ref="model_hr_appraisal_goal"/>
        <field name="domain_force">[
            ('employee_ids', '!=', False),
            '|',
                '|',
                    '|',
                        '|',
                            ('is_manager', '=', True),
                            ('employee_ids.user_id', '=', user.id),
                        ('manager_ids.user_id', '=', user.id),
                    '&amp;',
                        ('employee_ids.parent_id', '!=', False),
                        ('employee_ids.parent_id.user_id', '=', user.id),
                '&amp;',
                    ('employee_ids.last_appraisal_id.manager_ids.user_id', '=', user.id),
                    ('employee_ids.last_appraisal_id.state', 'in', ['1_new', '2_pending'])
        ]</field>
        <field name="perm_create" eval="True"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_read" eval="True"/>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <record id="hr_appraisal_goal_template_own_write" model="ir.rule">
        <field name="name">Appraisal: An employee can edit his own goals or his subordinates' (only goals without child)</field>
        <field name="model_id" ref="model_hr_appraisal_goal"/>
        <field name="domain_force">[
            ('child_ids', '=', False),
            ('employee_ids', '!=', False),
            '|',
                '|',
                    '|',
                        '|',
                            ('is_manager', '=', True),
                            ('employee_ids.user_id', '=', user.id),
                        ('manager_ids.user_id', '=', user.id),
                    '&amp;',
                        ('employee_ids.parent_id', '!=', False),
                        ('employee_ids.parent_id.user_id', '=', user.id),
                '&amp;',
                    ('employee_ids.last_appraisal_id.manager_ids.user_id', '=', user.id),
                    ('employee_ids.last_appraisal_id.state', 'in', ['1_new', '2_pending'])
        ]</field>
        <field name="perm_create" eval="False"/>
        <field name="perm_write" eval="True"/>
        <field name="perm_read" eval="False"/>
        <field name="perm_unlink" eval="False"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <record id="hr_appraisal_goal_own_delete" model="ir.rule">
    <field name="name">Appraisal: An employee can delete his own goals,if he created it, or his subordinates'</field>
        <field name="model_id" ref="model_hr_appraisal_goal"/>
        <field name="domain_force">[
            ('employee_ids', '!=', False),
            '|',
                '&amp;',
                    ('employee_ids.user_id', '=', user.id),
                    ('create_uid', '=', user.id),
                '|',
                    '&amp;',
                        ('employee_ids.user_id', '!=', user.id),
                        ('employee_ids.parent_id.user_id', '=', user.id),
                    '&amp;',
                        ('employee_ids.last_appraisal_id.manager_ids.user_id', '=', user.id),
                        ('employee_ids.last_appraisal_id.state', 'in', ['1_new', '2_pending']),
        ]</field>
        <field name="perm_create" eval="False"/>
        <field name="perm_read" eval="False"/>
        <field name="perm_write" eval="False"/>
        <field name="perm_unlink" eval="True"/>
        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
    </record>
    </data>
</odoo>