diff --git a/odex25_purchase/odex25_purchase_coc/security/security.xml b/odex25_purchase/odex25_purchase_coc/security/security.xml
index 972e4b553..2eb131ec2 100644
--- a/odex25_purchase/odex25_purchase_coc/security/security.xml
+++ b/odex25_purchase/odex25_purchase_coc/security/security.xml
@@ -48,7 +48,15 @@
             <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_purchase_coc_direct_manager'))]"/>
         </record>
 
-
+     <record id="purchase_coc_rule_employee" model="ir.rule">
+            <field name="name">CoC - Employee</field>
+            <field name="model_id" ref="model_purchase_coc"/>
+            <field name="domain_force">
+                ['|', ('create_uid', '=', user.id),
+                      ('po_id.request_id.employee_id.user_id', '=', user.id)]
+            </field>
+            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_user'))]"/>
+        </record>
             <record id="purchase_coc_rule_department_manager" model="ir.rule">
                 <field name="name">Purchase CoC - Department Manager Only (No Request)</field>
                 <field name="model_id" ref="model_purchase_coc"/>
@@ -62,6 +70,34 @@
             </record>
 
 <!--this for direct manager-->
+        <!--this for direct manager-->
+
+
+
+        <record id="purchase_coc_rule_department_parent_manager" model="ir.rule">
+            <field name="name">CoC - Department Parent Manager</field>
+            <field name="model_id" ref="model_purchase_coc"/>
+            <field name="domain_force">
+                [
+                    ('po_id.request_id', '=', False),
+                    ('po_id.department_id.manager_id.parent_id.user_id', '=', user.id)
+                ]
+            </field>
+            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_purchase_coc_direct_manager'))]"/>
+        </record>
+
+        <record id="purchase_coc_rule_coach" model="ir.rule">
+            <field name="name">CoC - Coach</field>
+            <field name="model_id" ref="model_purchase_coc"/>
+            <field name="domain_force">
+                ['|',
+                    ('po_id.request_id.employee_id.coach_id.user_id', '=', user.id),
+                    ('po_id.department_id.manager_id.coach_id.user_id', '=', user.id)
+                ]
+            </field>
+            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_manager'))]"/>
+        </record>
+
 
         <!-- Purchase COC Rules -->
         <record id="purchase_coc_rule_user" model="ir.rule">