odex25_standard/odex25_purchase/odex25_purchase_coc/security/security.xml

<?xml version="1.0" encoding="UTF-8" ?>
<odoo>
    <data>
    <record id="module_category_coc" model="ir.module.category">
        <field name="name">COC Management</field>
        <field name="description">Category for COC custom module</field>
        <field name="sequence">25</field>
    </record>
        <!-- Purchase COC groups -->
        <record id="group_coc_user" model="res.groups">
            <field name="name">COC User</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>

        <record id="group_coc_manager" model="res.groups">
            <field name="name">COC Manager</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>

         <record id="group_coc_menu" model="res.groups">
            <field name="name">COC Menu</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>



        <record id="group_coc_manager_direct" model="res.groups">
            <field name="name">Manager Direct Group</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>
          <record id="group_coc_manual_receipt" model="res.groups">
            <field name="name">Manual Receipt</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>

<!--this for direct manager-->
        <record id="group_purchase_coc_direct_manager" model="res.groups">
            <field name="name">Direct Manager</field>
            <field name="category_id" ref="odex25_purchase_coc.module_category_coc"/>
        </record>

        <record id="purchase_coc_rule_direct_manager" model="ir.rule">
            <field name="name">Purchase CoC - Direct Manager Only</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">
                [('po_id.request_id.employee_id.parent_id.user_id', '=', user.id)]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_purchase_coc_direct_manager'))]"/>
        </record>

     <record id="purchase_coc_rule_employee" model="ir.rule">
            <field name="name">CoC - Employee</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">
                ['|', ('create_uid', '=', user.id),
                      ('po_id.request_id.employee_id.user_id', '=', user.id)]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_user'))]"/>
        </record>
            <record id="purchase_coc_rule_department_manager" model="ir.rule">
                <field name="name">Purchase CoC - Department Manager Only (No Request)</field>
                <field name="model_id" ref="model_purchase_coc"/>
                <field name="domain_force">
                    [
                        ('po_id.request_id', '=', False),
                        ('po_id.department_id.manager_id.user_id', '=', user.id)
                    ]
                </field>
                <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_purchase_coc_direct_manager'))]"/>
            </record>

<!--this for direct manager-->
        <!--this for direct manager-->



        <record id="purchase_coc_rule_department_parent_manager" model="ir.rule">
            <field name="name">CoC - Department Parent Manager</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">
                [
                    ('po_id.request_id', '=', False),
                    ('po_id.department_id.manager_id.parent_id.user_id', '=', user.id)
                ]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_purchase_coc_direct_manager'))]"/>
        </record>

        <record id="purchase_coc_rule_coach" model="ir.rule">
            <field name="name">CoC - Coach</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">
                ['|',
                    ('po_id.request_id.employee_id.coach_id.user_id', '=', user.id),
                    ('po_id.department_id.manager_id.coach_id.user_id', '=', user.id)
                ]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_manager'))]"/>
        </record>


        <!-- Purchase COC Rules -->
        <record id="purchase_coc_rule_user" model="ir.rule">
            <field name="name">Purchase COC Employee</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">['|','|',('create_uid', '=', user.id),('po_id.request_id.employee_id.user_id','=',user.id),
                '&amp;',('po_id.request_id', '=', False),('po_id.user_id', '=', user.id)]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_user'))]"/>
        </record>

       <record id="purchase_coc_rule_manager" model="ir.rule">
            <field name="name">Purchase COC – With Request (CEO or Creator)</field>
            <field name="model_id" ref="model_purchase_coc"/>
            <field name="domain_force">
                ['&amp;',
                    ('po_id.request_id', '!=', False),
                    '|',
                        ('create_uid', '=', user.id),
                        ('po_id.request_id.chief_executive_officer', '=', user.id)
                ]
            </field>
            <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_manager'))]"/>
        </record>



                  <record id="purchase_coc_rule_manager_no_request" model="ir.rule">
                        <field name="name">Purchase COC – No Request (CEO or Creator)</field>
                        <field name="model_id" ref="model_purchase_coc"/>
                        <field name="domain_force">
                            ['&amp;',
                                ('po_id.request_id', '=', False),
                                '|',
                                    ('create_uid', '=', user.id),
                                    ('po_id.chief_executive_officer', '=', user.id)
                            ]
                        </field>
                        <field name="groups" eval="[(4, ref('odex25_purchase_coc.group_coc_manager'))]"/>
                    </record>







        <record id="show_all_coc_purchase_rule" model="ir.rule">
            <field name="name">Show All Purchase COC</field>
            <field name="model_id" ref="model_purchase_coc" />
            <field eval="True" name="global" />
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="groups" eval="[(4,ref('purchase.group_purchase_manager'))]"/>
        </record>

    </data>
</odoo>