• Conditions that records must satisfy for an operation (create, read, update or delete) to be allowed.
• Boolean fields (read, write, create, delete) of ir.rule mean Apply this rule for this kind of operation.
• Mechanisms to manage or restrict access to data.
• Make use of domain to specify which records can be selected.

Global rules and group rules - (rules restricted to specific groups VERSUS groups applying to all users)

• Name

<field name = "name"> Rule_name </field>

• Model on which it applies

<field ref = "module.model for this rule" name = "model_id" />

• Set of user groups to which the rule applies, if no group is specified the rule is global

<field name = "groups" eval = " [(4, ref ('group of this rule'))] "/>

• Domain used to check whether a given record matches the rule (and is accessible) or does not (and is not accessible).

<field name="domain_force">here add your new domain</field>

Group : Sales / User: Own Documents Only

['|',
  ('user_id','=',user.id),
  ('user_id','=',False)
] 

This mean: - user can access just to his own orders / quotations . - orders with no specific user .

Group : Sales / User: All Documents

[(1,'=',1)] This will grant access to ALL Sales Orders / Quotations.