diff --git a/odex25_base/tour_genius/__manifest__.py b/odex25_base/tour_genius/__manifest__.py
index dd6c788c1..ccf0f78f5 100644
--- a/odex25_base/tour_genius/__manifest__.py
+++ b/odex25_base/tour_genius/__manifest__.py
@@ -34,6 +34,7 @@ Author: Expert Development Team
         # Security
         'security/security.xml',
         'security/ir.model.access.csv',
+        'security/rules.xml',
         # Data (Crons)
         'data/cron_data.xml',
         # Assets (MUST load before views for JS to register)
diff --git a/odex25_base/tour_genius/models/res_users.py b/odex25_base/tour_genius/models/res_users.py
index 11c5888c8..560820d85 100644
--- a/odex25_base/tour_genius/models/res_users.py
+++ b/odex25_base/tour_genius/models/res_users.py
@@ -65,3 +65,5 @@ class ResUsers(models.Model):
             user.genius_completed_topics = completed
             user.genius_in_progress_topics = in_progress
             user.genius_total_time_hours = total_time / 60.0 if total_time else 0.0
+
+
diff --git a/odex25_base/tour_genius/security/ir.model.access.csv b/odex25_base/tour_genius/security/ir.model.access.csv
index f48bc50d9..3db1d518a 100644
--- a/odex25_base/tour_genius/security/ir.model.access.csv
+++ b/odex25_base/tour_genius/security/ir.model.access.csv
@@ -2,22 +2,31 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_plan_user,genius.plan.user,model_genius_plan,group_genius_user,1,0,0,0
 access_plan_instructor,genius.plan.instructor,model_genius_plan,group_genius_instructor,1,1,1,0
 access_plan_admin,genius.plan.admin,model_genius_plan,group_genius_admin,1,1,1,1
+access_topic_standard_user,genius.topic.standard.user,model_genius_topic,base.group_user,1,0,0,0
 access_topic_user,genius.topic.user,model_genius_topic,group_genius_user,1,0,0,0
 access_topic_instructor,genius.topic.instructor,model_genius_topic,group_genius_instructor,1,1,1,1
+access_step_standard_user,genius.topic.step.standard.user,model_genius_topic_step,base.group_user,1,0,0,0
 access_step_user,genius.topic.step.user,model_genius_topic_step,group_genius_user,1,0,0,0
 access_step_instructor,genius.topic.step.instructor,model_genius_topic_step,group_genius_instructor,1,1,1,1
+access_progress_standard_user,genius.progress.user,model_genius_progress,base.group_user,1,1,1,0
 access_progress_user,genius.progress.user,model_genius_progress,group_genius_user,1,1,1,0
 access_progress_instructor,genius.progress.instructor,model_genius_progress,group_genius_instructor,1,1,1,1
+access_tag_standard_user,genius.tour.tag.standard.user,model_genius_tour_tag,base.group_user,1,0,0,0
 access_tag_user,genius.tour.tag.user,model_genius_tour_tag,group_genius_user,1,0,0,0
 access_tag_instructor,genius.tour.tag.instructor,model_genius_tour_tag,group_genius_instructor,1,1,1,1
+access_quiz_standard_user,genius.quiz.standard.user,model_genius_quiz,base.group_user,1,0,0,0
 access_quiz_user,genius.quiz.user,model_genius_quiz,group_genius_user,1,0,0,0
 access_quiz_instructor,genius.quiz.instructor,model_genius_quiz,group_genius_instructor,1,1,1,1
+access_question_standard_user,genius.quiz.question.standard.user,model_genius_quiz_question,base.group_user,1,0,0,0
 access_question_user,genius.quiz.question.user,model_genius_quiz_question,group_genius_user,1,0,0,0
 access_question_instructor,genius.quiz.question.instructor,model_genius_quiz_question,group_genius_instructor,1,1,1,1
+access_answer_standard_user,genius.quiz.answer.standard.user,model_genius_quiz_answer,base.group_user,1,0,0,0
 access_answer_user,genius.quiz.answer.user,model_genius_quiz_answer,group_genius_user,1,0,0,0
 access_answer_instructor,genius.quiz.answer.instructor,model_genius_quiz_answer,group_genius_instructor,1,1,1,1
+access_attempt_standard_user,genius.quiz.attempt.standard.user,model_genius_quiz_attempt,base.group_user,1,1,1,0
 access_attempt_user,genius.quiz.attempt.user,model_genius_quiz_attempt,group_genius_user,1,1,1,0
 access_attempt_instructor,genius.quiz.attempt.instructor,model_genius_quiz_attempt,group_genius_instructor,1,1,1,1
+access_response_standard_user,genius.quiz.response.user,model_genius_quiz_response,base.group_user,1,1,1,0
 access_response_user,genius.quiz.response.user,model_genius_quiz_response,group_genius_user,1,1,1,0
 access_response_instructor,genius.quiz.response.instructor,model_genius_quiz_response,group_genius_instructor,1,1,1,1
 access_leaderboard_user,genius.leaderboard.user,model_genius_leaderboard,group_genius_user,1,0,0,0
diff --git a/odex25_base/tour_genius/security/rules.xml b/odex25_base/tour_genius/security/rules.xml
new file mode 100644
index 000000000..664561382
--- /dev/null
+++ b/odex25_base/tour_genius/security/rules.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <data noupdate="1">
+        
+        <!-- Record Rule: Standard Users can only see Published Topics -->
+        <record id="rule_genius_topic_published_only" model="ir.rule">
+            <field name="name">Genius Topic: Published Only for Standard Users</field>
+            <field name="model_id" ref="model_genius_topic"/>
+            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+            <field name="domain_force">[('state', '=', 'published'), ('active', '=', True)]</field>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="False"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
+        
+        <!-- Record Rule: Genius Users/Instructors/Admins see everything (handled by existing group rules or lack thereof) -->
+        <!-- Odoo's additive nature means if they are in group_genius_user, they might need an explicit rule if global rules restrict them, 
+             BUT here we are applying a GROUP rule to base.group_user. 
+             If a Genius User is ALSO a base.group_user (which they are), this rule applies.
+             SO we must allow Genius Users to see everything via another rule or make the above rule EXCLUDE them?
+             Actually, access rights are additive but Record Rules are:
+             - Global rules (no group) are INTERSECTED (AND)
+             - Group rules are UNIONED (OR)
+             
+             So if I add a rule for base.group_user, it allows access to published.
+             I need another rule for group_genius_user to allow access to ALL (or draft).
+        -->
+
+        <record id="rule_genius_topic_all_for_genius_users" model="ir.rule">
+            <field name="name">Genius Topic: All for Genius Users</field>
+            <field name="model_id" ref="model_genius_topic"/>
+            <field name="groups" eval="[(4, ref('group_genius_user'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field> <!-- Allow everything -->
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_create" eval="True"/>
+            <field name="perm_unlink" eval="True"/>
+        </record>
+
+    </data>
+</odoo>