[ADD] *: add ir.model.access on all transient models

Following changes needing ir.model.access on transient models too.
Remove groups declaration on the action to move it to ir.model.access
when possible.
Rules are strict by default with no unlink access by default and high
priviledge asked. Adaptations may be needed later.
Write access is given as a wizard may need to be modified in case the
action triggers an error and the user has to correct a value

account*: use account.group_account_user for all transient by default
	  remove account.print.journal relic
stock*: use stock.group_stock_user by default
survey: survey user can send invitations
mail: allow any employee to execute wizards
      additional verifications are made to ensure they are executed
      only on the documents the user has access to you
      give portal access to mail.compose.message as portal still does
      some actions like posting messages on the forum
      add ir.rule to avoid reading somebody else messages
      increase the query count because of undeterminist count
crm: saleman for lead2opp, manager for massmailing
     partner manager for actions linked to partners
     avoid a write in test_lead_lost
sms: any employee can send sms
mrp: mrp user can execute wizards
     give unlink access as making write during do_produce operation
base_import: employees can import files
delivery: stock user can deliver
event_sale: sale user can configure the wizards
	    event user inherit from  sale rights
gamification: employee can give badge
google_service: resolve FIXME
hr: add specific rights
    manager can set a plan according to group on button
    anyone who can write on an employee can register a departure
hr_expense: set rights based on buttons
hr_holidays: an approver can make a summary report
hr_recruitment: recruiter can refuse a candidate
hr_timesheet: can use the wizard if can create a timesheet
l10n_eu_service: managers can create fiscal positions
mass_mailing: same group as on mass.mailing.list
membership: accountant can create invoice from membership
payment: accountant can create a link
	 as the source is an account.move
	 keep the payment.acquirer.onboarding.wizard to system user
	 only as it is called during company configuration
point_of_sale: PoS manager only can use wizards
	       never create closing_balance_confirm_wizard records
product_expiry: stock user has rights on stock.picking
product_margin: access from accounting menus
repair: same rules as for above models
sale: set ir.rule for self wizard only
      add rule from model introduced in payment to add salesman group
sale_crm: saleman can create a quotation from a lead
sale_coupon: any saleman can generate coupon
	     add self ir.rule
sale_product_configurator: salesman can select product variants
snailmail: employee can send letters
website: designers can write on website
website_crm_partner_assign: same rule as group on action
website_sale: sale ACL as for payment.acquirer.onboarding.wizard
website_slides: anyone can send invitation

base: base.language.*: allow employee (cf lang_install)
      change.password.user: can not read change password wizard of
      other users
      test.*: no access is needed

Courtesy of Damien Bouvy, William Andre and Antoine Prieëls for review
of acl

73 files changed, 241 insertions, 36 deletions

diff --git a/addons/account/security/ir.model.access.csv b/addons/account/security/ir.model.access.csv
index bc5f6536810..90962c9c44a 100644
--- a/addons/account/security/ir.model.access.csv
+++ b/addons/account/security/ir.model.access.csv
@@ -123,3 +123,19 @@ access_account_payment_method_readonly,account.payment.method,model_account_paym
 access_account_payment_method,account.payment.method,model_account_payment_method,account.group_account_invoice,1,1,1,1
 access_account_payment_readonly,account.payment,model_account_payment,account.group_account_readonly,1,0,0,0
 access_account_payment,account.payment,model_account_payment,account.group_account_invoice,1,1,1,1
+
+access_account_payment_register,access.account.payment.register,model_account_payment_register,account.group_account_invoice,1,1,1,0
+access_account_bank_statement_closebalance,access.account.bank.statement.closebalance,model_account_bank_statement_closebalance,account.group_account_user,1,1,1,0
+access_account_accrual_accounting_wizard,access.account.accrual.accounting.wizard,model_account_accrual_accounting_wizard,account.group_account_user,1,1,1,0
+access_account_unreconcile,access.account.unreconcile,model_account_unreconcile,account.group_account_user,1,1,1,0
+access_validate_account_move,access.validate.account.move,model_validate_account_move,account.group_account_invoice,1,1,1,0
+access_cash_box_out,access.cash.box.out,model_cash_box_out,account.group_account_user,1,1,1,0
+access_account_move_reversal,access.account.move.reversal,model_account_move_reversal,account.group_account_invoice,1,1,1,0
+access_account_common_report,access.account.common.report,model_account_common_report,account.group_account_user,1,1,1,0
+access_account_common_journal_report,access.account.common.journal.report,model_account_common_journal_report,account.group_account_user,1,1,1,0
+access_account_print_journal,access.account.print.journal,model_account_print_journal,account.group_account_user,1,1,1,0
+access_account_financial_year_op,access.account.financial.year.op,model_account_financial_year_op,account.group_account_manager,1,1,1,0
+access_account_setup_bank_manual_config,access.account.setup.bank.manual.config,model_account_setup_bank_manual_config,account.group_account_user,1,1,1,0
+access_tax_adjustments_wizard,access.tax.adjustments.wizard,model_tax_adjustments_wizard,account.group_account_user,1,1,1,0
+access_account_invoice_send,access.account.invoice.send,model_account_invoice_send,account.group_account_invoice,1,1,1,0
+access_account_transfer_wizard,access.account.transfer.wizard,model_account_transfer_wizard,account.group_account_user,1,1,1,0
diff --git a/addons/account/wizard/account_invoice_send_views.xml b/addons/account/wizard/account_invoice_send_views.xml
index 4db286a1ca8..3ec9db79a9b 100644
--- a/addons/account/wizard/account_invoice_send_views.xml
+++ b/addons/account/wizard/account_invoice_send_views.xml
@@ -86,8 +86,7 @@
             context="{
                 'default_template_id': ref('account.email_template_edi_invoice'),
                 'mark_invoice_as_sent': True,
-            }"
-            groups="account.group_account_invoice"/>
+            }"/>
 
     </data>
 
diff --git a/addons/account_check_printing/__manifest__.py b/addons/account_check_printing/__manifest__.py
index fbcd0bb7d39..4882c5ee815 100644
--- a/addons/account_check_printing/__manifest__.py
+++ b/addons/account_check_printing/__manifest__.py
@@ -13,6 +13,7 @@ The check settings are located in the accounting journals configuration page.
     """,
     'depends': ['account'],
     'data': [
+        'security/ir.model.access.csv',
         'data/account_check_printing_data.xml',
         'views/account_journal_views.xml',
         'views/account_payment_views.xml',
diff --git a/addons/account_check_printing/security/ir.model.access.csv b/addons/account_check_printing/security/ir.model.access.csv
new file mode 100644
index 00000000000..4009faf214b
--- /dev/null
+++ b/addons/account_check_printing/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_print_prenumbered_checks","access.print.prenumbered.checks","model_print_prenumbered_checks","account.group_account_user",1,1,1,0
diff --git a/addons/base_gengo/__manifest__.py b/addons/base_gengo/__manifest__.py
index 55e2355511f..b2bda792a01 100644
--- a/addons/base_gengo/__manifest__.py
+++ b/addons/base_gengo/__manifest__.py
@@ -16,6 +16,7 @@ This wizard will activate the CRON job and the Scheduler and will start the auto
     """,
     'depends': ['base_setup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/ir_cron_data.xml',
         'views/ir_translation_views.xml',
         'views/res_config_settings_views.xml',
diff --git a/addons/base_gengo/security/ir.model.access.csv b/addons/base_gengo/security/ir.model.access.csv
new file mode 100644
index 00000000000..b123cc2587f
--- /dev/null
+++ b/addons/base_gengo/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_gengo_translations","access.base.gengo.translations","model_base_gengo_translations","base.group_system",1,1,1,0
diff --git a/addons/base_import/security/ir.model.access.csv b/addons/base_import/security/ir.model.access.csv
index 06a166c91c9..f6105333408 100644
--- a/addons/base_import/security/ir.model.access.csv
+++ b/addons/base_import/security/ir.model.access.csv
@@ -15,3 +15,4 @@ access_base_import_tests_models_float,base.import.tests.models.float,model_base_
 access_base_import_tests_models_preview,base.import.tests.models.preview,model_base_import_tests_models_preview,base.group_user,1,1,1,1
 access_base_import_mapping,base.import.mapping,model_base_import_mapping,base.group_user,1,1,1,1
 access_base_import_tests_models_complex,access_base_import_tests_models_complex,model_base_import_tests_models_complex,base.group_user,1,0,0,0
+access_base_import_import,access.base_import.import,model_base_import_import,base.group_user,1,1,1,0
diff --git a/addons/base_import_module/__manifest__.py b/addons/base_import_module/__manifest__.py
index 0504bcfd6b3..e5b45d6337c 100644
--- a/addons/base_import_module/__manifest__.py
+++ b/addons/base_import_module/__manifest__.py
@@ -13,5 +13,8 @@ for customization purpose.
     'depends': ['web'],
     'installable': True,
     'auto_install': False,
-    'data': ['views/base_import_module_view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'views/base_import_module_view.xml'
+    ],
 }
diff --git a/addons/base_import_module/security/ir.model.access.csv b/addons/base_import_module/security/ir.model.access.csv
new file mode 100644
index 00000000000..35b8d2bc0d9
--- /dev/null
+++ b/addons/base_import_module/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_import_module","access.base.import.module","model_base_import_module","base.group_system",1,1,1,0
diff --git a/addons/base_sparse_field/__manifest__.py b/addons/base_sparse_field/__manifest__.py
index d98d9cb81a0..a13593b783f 100644
--- a/addons/base_sparse_field/__manifest__.py
+++ b/addons/base_sparse_field/__manifest__.py
@@ -12,6 +12,7 @@
     'version': '1.0',
     'depends': ['base'],
     'data': [
+        'security/ir.model.access.csv',
         'views/views.xml',
     ],
 }
diff --git a/addons/base_sparse_field/security/ir.model.access.csv b/addons/base_sparse_field/security/ir.model.access.csv
new file mode 100644
index 00000000000..c163e1f2c64
--- /dev/null
+++ b/addons/base_sparse_field/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sparse_fields_test","access.sparse_fields.test","model_sparse_fields_test","base.group_system",1,1,1,0
diff --git a/addons/crm/security/ir.model.access.csv b/addons/crm/security/ir.model.access.csv
index 7269054d25b..95308da62b1 100644
--- a/addons/crm/security/ir.model.access.csv
+++ b/addons/crm/security/ir.model.access.csv
@@ -23,3 +23,8 @@ access_calendar_event_type_sale_salesman,calendar.event.type.salesman,calendar.m
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1

 access_crm_lead_scoring_frequency,access_crm_lead_scoring_frequency,model_crm_lead_scoring_frequency,sales_team.group_sale_salesman,1,0,0,0

 access_crm_lead_scoring_frequency_field,access_crm_lead_scoring_frequency_field,model_crm_lead_scoring_frequency_field,sales_team.group_sale_salesman,1,0,0,0

+access_crm_lead_lost,access.crm.lead.lost,model_crm_lead_lost,sales_team.group_sale_salesman,1,1,1,0

+access_crm_partner_binding,access.crm.partner.binding,model_crm_partner_binding,base.group_partner_manager,1,1,1,0

+access_crm_lead2opportunity_partner,access.crm.lead2opportunity.partner,model_crm_lead2opportunity_partner,sales_team.group_sale_salesman,1,1,1,0

+access_crm_lead2opportunity_partner_mass,access.crm.lead2opportunity.partner.mass,model_crm_lead2opportunity_partner_mass,sales_team.group_sale_salesman,1,1,1,0

+access_crm_merge_opportunity,access.crm.merge.opportunity,model_crm_merge_opportunity,sales_team.group_sale_salesman,1,1,1,0

diff --git a/addons/crm/tests/test_crm_lead_lost.py b/addons/crm/tests/test_crm_lead_lost.py
index 1cc0defab98..7f2819f7825 100644
--- a/addons/crm/tests/test_crm_lead_lost.py
+++ b/addons/crm/tests/test_crm_lead_lost.py
@@ -28,9 +28,10 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids,
-        }).create({})
+        }).create({
+            'lost_reason_id': self.lost_reason.id
+        })
 
-        lost_wizard.write({'lost_reason_id': self.lost_reason.id})
         lost_wizard.action_lost_reason_apply()
 
         self.assertEqual(lead.probability, 0)
@@ -55,8 +56,9 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids
-        }).create({})
-        lost_wizard.write({'lost_reason_id': lost_reason.id})
+        }).create({
+            'lost_reason_id': lost_reason.id
+        })
 
         # nice try little salesman, you cannot invoke a wizard to update other people leads
         with self.assertRaises(AccessError):
diff --git a/addons/crm/views/crm_lead_views.xml b/addons/crm/views/crm_lead_views.xml
index bdb2cbaf82c..0f364c4df71 100644
--- a/addons/crm/views/crm_lead_views.xml
+++ b/addons/crm/views/crm_lead_views.xml
@@ -751,7 +751,6 @@
                             'default_use_template': True,
                             'default_template_id': ref('crm.email_template_opportunity_mail'),
                         }"
-                groups="sales_team.group_sale_salesman"
                 />
 
         <!--Update of email_template defined in crm_lead_data, to add ref_ir_act_window
diff --git a/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml b/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
index 539a270556e..428812fddd4 100644
--- a/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
+++ b/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
@@ -58,6 +58,5 @@
         view_mode="form" target="new"
         context="{'mass_convert' : True}"
         view_id="view_crm_lead2opportunity_partner_mass"
-        groups="sales_team.group_sale_salesman"
     />
 </odoo>
diff --git a/addons/crm/wizard/crm_merge_opportunities_views.xml b/addons/crm/wizard/crm_merge_opportunities_views.xml
index 8b253dccec0..2eabe079cb9 100644
--- a/addons/crm/wizard/crm_merge_opportunities_views.xml
+++ b/addons/crm/wizard/crm_merge_opportunities_views.xml
@@ -40,7 +40,6 @@
             binding_model="crm.lead"
             binding_views="list"
             view_mode="form"
-            target="new"
-            groups="sales_team.group_sale_salesman" />
+            target="new" />
 
 </odoo>
diff --git a/addons/delivery/security/ir.model.access.csv b/addons/delivery/security/ir.model.access.csv
index 9c3f08c7a90..376581b094e 100644
--- a/addons/delivery/security/ir.model.access.csv
+++ b/addons/delivery/security/ir.model.access.csv
@@ -7,3 +7,5 @@ access_delivery_carrier_partner_manager,delivery.carrier partner_manager,model_d
 access_delivery_carrier_stock_user,delivery.carrier stock_user,model_delivery_carrier,stock.group_stock_user,1,0,0,0

 access_delivery_carrier_stock_manager,delivery.carrier,model_delivery_carrier,stock.group_stock_manager,1,1,1,1

 access_delivery_price_rule_stock_manager,delivery.price.rule,model_delivery_price_rule,stock.group_stock_manager,1,1,1,1

+access_choose_delivery_package,access.choose.delivery.package,model_choose_delivery_package,stock.group_stock_user,1,1,1,0

+access_choose_delivery_carrier,access.choose.delivery.carrier,model_choose_delivery_carrier,stock.group_stock_user,1,1,1,0

diff --git a/addons/event_sale/security/ir.model.access.csv b/addons/event_sale/security/ir.model.access.csv
index fbbe3fbeb29..06b66e1cf00 100644
--- a/addons/event_sale/security/ir.model.access.csv
+++ b/addons/event_sale/security/ir.model.access.csv
@@ -1,3 +1,6 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_product_template_event_manager,product.template.event.manager,product.model_product_template,event.group_event_manager,1,1,1,1
 access_product_product_event_manager,product.product.event.manager,product.model_product_product,event.group_event_manager,1,1,1,1
+access_registration_editor,access.registration.editor,model_registration_editor,sales_team.group_sale_salesman,1,1,1,0
+access_registration_editor_line,access.registration.editor.line,model_registration_editor_line,sales_team.group_sale_salesman,1,1,1,1
+access_event_event_configurator,access.event.event.configurator,model_event_event_configurator,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/gamification/security/ir.model.access.csv b/addons/gamification/security/ir.model.access.csv
index 728360ab386..ed8f9ffc8bb 100644
--- a/addons/gamification/security/ir.model.access.csv
+++ b/addons/gamification/security/ir.model.access.csv
@@ -30,3 +30,6 @@ gamification_karma_rank_access_all,gamification.karma.rank.access.all,gamificati
 gamification_karma_rank_access_user_manager,gamification.karma.rank.access.user.manager,gamification.model_gamification_karma_rank,base.group_system,1,1,1,1
 gamification_karma_tracking_access_all,gamification.karma.tracking.access.all,gamification.model_gamification_karma_tracking,,0,0,0,0
 gamification_karma_tracking_access_user_manager,gamification.karma.tracking.access.user.manager,gamification.model_gamification_karma_tracking,base.group_system,1,1,1,1
+
+access_gamification_goal_wizard,access.gamification.goal.wizard,model_gamification_goal_wizard,base.group_user,1,1,1,0
+access_gamification_badge_user_wizard,access.gamification.badge.user.wizard,model_gamification_badge_user_wizard,base.group_user,1,1,1,0
diff --git a/addons/google_account/models/google_service.py b/addons/google_account/models/google_service.py
index 384a565ced5..c424dd687af 100644
--- a/addons/google_account/models/google_service.py
+++ b/addons/google_account/models/google_service.py
@@ -22,8 +22,7 @@ GOOGLE_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/token'
 GOOGLE_API_BASE_URL = 'https://www.googleapis.com'
 
 
-# FIXME : this needs to become an AbstractModel, to be inhereted by google_calendar_service and google_drive_service
-class GoogleService(models.TransientModel):
+class GoogleService(models.AbstractModel):
     _name = 'google.service'
     _description = 'Google Service'
 
diff --git a/addons/hr/security/ir.model.access.csv b/addons/hr/security/ir.model.access.csv
index e28b4065ee3..906cef3ee87 100644
--- a/addons/hr/security/ir.model.access.csv
+++ b/addons/hr/security/ir.model.access.csv
@@ -13,3 +13,5 @@ access_hr_plan_activity_type_employee,access_hr_plan_activity_type,model_hr_plan
 access_hr_plan_employee,access_hr_plan_employee,model_hr_plan,base.group_user,1,0,0,0

 access_hr_plan_activity_type_hr_user,access_hr_plan_activity_type,model_hr_plan_activity_type,group_hr_user,1,1,1,1

 access_hr_plan_hr_user,access_hr_plan_hr_user,model_hr_plan,group_hr_user,1,1,1,1

+access_hr_plan_wizard,access.hr.plan.wizard,model_hr_plan_wizard,hr.group_hr_manager,1,1,1,0

+access_hr_departure_wizard,access.hr.departure.wizard,model_hr_departure_wizard,hr.group_hr_user,1,1,1,0

diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv
index 3f44a089213..8db618224fd 100644
--- a/addons/hr_expense/security/ir.model.access.csv
+++ b/addons/hr_expense/security/ir.model.access.csv
@@ -16,3 +16,5 @@ access_account_move_user,account.move.user,account.model_account_move,hr_expense
 access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0

 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1

 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1

+access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0

+access_hr_expense_sheet_register_payment_wizard,access.hr.expense.sheet.register.payment.wizard,model_hr_expense_sheet_register_payment_wizard,account.group_account_manager,1,1,1,0

diff --git a/addons/hr_holidays/security/ir.model.access.csv b/addons/hr_holidays/security/ir.model.access.csv
index ec266b6e4d0..5c966878c8a 100644
--- a/addons/hr_holidays/security/ir.model.access.csv
+++ b/addons/hr_holidays/security/ir.model.access.csv
@@ -14,3 +14,4 @@ access_calendar_event_hr_user,calendar.event.hr.user,calendar.model_calendar_eve
 access_calendar_event_type_manager,calendar.event.type.manager,calendar.model_calendar_event_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
 access_calendar_attendee_hr_user,calendar.attendee.hr.user,calendar.model_calendar_attendee,hr_holidays.group_hr_holidays_user,1,1,1,1
 access_mail_activity_type_holidays_manager,mail.activity.type.holidays.manager,mail.model_mail_activity_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
+access_hr_holidays_summary_employee,access.hr.holidays.summary.employee,model_hr_holidays_summary_employee,hr_holidays.group_hr_holidays_user,1,1,1,0
diff --git a/addons/hr_recruitment/security/ir.model.access.csv b/addons/hr_recruitment/security/ir.model.access.csv
index c33c641e7b7..646f2a8857b 100644
--- a/addons/hr_recruitment/security/ir.model.access.csv
+++ b/addons/hr_recruitment/security/ir.model.access.csv
@@ -11,3 +11,4 @@ access_hr_recruitment_source_all,hr.recruitment.source,model_hr_recruitment_sour
 access_hr_applicant_category,hr.applicant_category,model_hr_applicant_category,,1,1,1,0

 access_hr_applicant_category_manager,hr.applicant_category,model_hr_applicant_category,group_hr_recruitment_user,1,1,1,1

 access_calendar_event_type_hr_officer,calendar.event.type.officer,calendar.model_calendar_event_type,group_hr_recruitment_user,1,1,1,0

+access_applicant_get_refuse_reason,access.applicant.get.refuse.reason,model_applicant_get_refuse_reason,hr_recruitment.group_hr_recruitment_user,1,1,1,0

diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index cb11fb119f7..db5329a5262 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -4,3 +4,4 @@ access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.m
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0

 access_project_project,project.project.timesheet.user,model_project_project,hr_timesheet.group_hr_timesheet_user,1,0,0,0

 access_project_task,project.task.timesheet.user,model_project_task,hr_timesheet.group_hr_timesheet_user,1,1,0,0

+access_project_task_create_timesheet,access.project.task.create.timesheet,model_project_task_create_timesheet,hr_timesheet.group_hr_timesheet_user,1,1,1,0

diff --git a/addons/l10n_eu_service/security/ir.model.access.csv b/addons/l10n_eu_service/security/ir.model.access.csv
index 7a41aa15907..65d7ff4f6db 100644
--- a/addons/l10n_eu_service/security/ir.model.access.csv
+++ b/addons/l10n_eu_service/security/ir.model.access.csv
@@ -1,3 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_l10n_eu_service_service_tax_rate_user,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,,1,0,0,0
 access_l10n_eu_service_service_tax_rate_manager,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,account.group_account_manager,1,1,1,1
+access_l10n_eu_service_wizard,access.l10n_eu_service.wizard,model_l10n_eu_service_wizard,account.group_account_manager,1,1,1,0
diff --git a/addons/mail/security/ir.model.access.csv b/addons/mail/security/ir.model.access.csv
index 2f21338e9f4..6a5e71f7e1e 100644
--- a/addons/mail/security/ir.model.access.csv
+++ b/addons/mail/security/ir.model.access.csv
@@ -38,3 +38,10 @@ access_mail_activity_type_all,mail.activity.type.all,model_mail_activity_type,,0
 access_mail_activity_type_user,mail.activity.type.user,model_mail_activity_type,base.group_user,1,0,0,0

 access_mail_activity_type_system,mail.activity.type.system,model_mail_activity_type,base.group_system,1,1,1,1

 access_mail_blacklist_system,access_mail_blacklist_system,model_mail_blacklist,base.group_system,1,1,1,1

+access_mail_wizard_invite,access.mail.wizard.invite,model_mail_wizard_invite,base.group_user,1,1,1,0

+access_mail_compose_message,access.mail.compose.message,model_mail_compose_message,base.group_user,1,1,1,0

+access_mail_compose_message_portal,access.mail.compose.message.portal,model_mail_compose_message,base.group_portal,1,1,1,0

+access_mail_resend_cancel,access.mail.resend.cancel,model_mail_resend_cancel,base.group_user,1,1,1,0

+access_mail_resend_message,access.mail.resend.message,model_mail_resend_message,base.group_user,1,1,1,0

+access_mail_resend_partner,access.mail.resend.partner,model_mail_resend_partner,base.group_user,1,1,1,0

+access_mail_template_preview,access.mail.template.preview,model_mail_template_preview,base.group_user,1,1,1,0

diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 3a98e1bddb2..036f9a275c2 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -47,5 +47,16 @@
             <field name="model_id" ref="model_mail_moderation"/>
             <field name="domain_force">[('channel_id.moderator_ids', 'in', user.id)]</field>
         </record>
+
+        <record id="mail_compose_message_rule" model="ir.rule">
+            <field name="name">Mail Compose Message Rule</field>
+            <field name="model_id" ref="model_mail_compose_message"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+            <field name="global" eval="True"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
     </data>
 </odoo>
diff --git a/addons/mass_mailing/security/ir.model.access.csv b/addons/mass_mailing/security/ir.model.access.csv
index 63d65ed09c7..063640e8906 100644
--- a/addons/mass_mailing/security/ir.model.access.csv
+++ b/addons/mass_mailing/security/ir.model.access.csv
@@ -14,3 +14,6 @@ access_utm_source,access_utm_source,utm.model_utm_source,mass_mailing.group_mass
 access_ir_mail_server,access_ir_mail_server,base.model_ir_mail_server,mass_mailing.group_mass_mailing_user,1,0,0,0

 access_mail_blacklist_mass_mailing_user,access.mail.blacklist.mass_mailing_user,mail.model_mail_blacklist,mass_mailing.group_mass_mailing_user,1,1,1,1

 access_link_tracker_mailing,access.link.tracker.mailing,link_tracker.model_link_tracker,mass_mailing.group_mass_mailing_user,1,1,1,1

+access_mailing_list_merge,access.mailing.list.merge,model_mailing_list_merge,mass_mailing.group_mass_mailing_user,1,1,1,0

+access_mailing_mailing_schedule_date,access.mailing.mailing.schedule.date,model_mailing_mailing_schedule_date,mass_mailing.group_mass_mailing_user,1,1,1,0

+access_mailing_mailing_test,access.mailing.mailing.test,model_mailing_mailing_test,mass_mailing.group_mass_mailing_user,1,1,1,0

diff --git a/addons/mass_mailing_sms/security/ir.model.access.csv b/addons/mass_mailing_sms/security/ir.model.access.csv
index 4a08a4aa60d..d6614405020 100644
--- a/addons/mass_mailing_sms/security/ir.model.access.csv
+++ b/addons/mass_mailing_sms/security/ir.model.access.csv
@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_mailing_sms_test,access.mailing.sms.test,model_mailing_sms_test,mass_mailing.group_mass_mailing_user,1,1,1,0
diff --git a/addons/membership/security/ir.model.access.csv b/addons/membership/security/ir.model.access.csv
index d53e57a5151..b0165407cdd 100644
--- a/addons/membership/security/ir.model.access.csv
+++ b/addons/membership/security/ir.model.access.csv
@@ -2,3 +2,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_membership_membership_line_partner_manager,membership.membership_line partner_manager,model_membership_membership_line,base.group_partner_manager,1,1,1,1

 access_membership_membership_line,membership.membership_line,model_membership_membership_line,,1,0,0,0

 access_report_membership,report.membership,model_report_membership,base.group_partner_manager,1,0,0,0

+access_membership_invoice,access.membership.invoice,model_membership_invoice,account.group_account_user,1,1,1,0

diff --git a/addons/mrp/security/ir.model.access.csv b/addons/mrp/security/ir.model.access.csv
index f658a124936..f3da2c3d932 100644
--- a/addons/mrp/security/ir.model.access.csv
+++ b/addons/mrp/security/ir.model.access.csv
@@ -60,3 +60,7 @@ access_mrp_unbuild,mrp.unbuild,model_mrp_unbuild,group_mrp_user,1,1,1,1
 access_mrp_unbuild_manager,mrp.unbuild manager,model_mrp_unbuild,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_manager,mrp.document group_user,model_mrp_document,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_user,mrp.document group_user,model_mrp_document,group_mrp_user,1,1,1,1
+access_mrp_product_produce,access.mrp.product.produce,model_mrp_product_produce,mrp.group_mrp_user,1,1,1,0
+access_mrp_product_produce_line,access.mrp.product.produce.line,model_mrp_product_produce_line,mrp.group_mrp_user,1,1,1,1
+access_change_production_qty,access.change.production.qty,model_change_production_qty,mrp.group_mrp_user,1,1,1,0
+access_stock_warn_insufficient_qty_unbuild,access.stock.warn.insufficient.qty.unbuild,model_stock_warn_insufficient_qty_unbuild,mrp.group_mrp_user,1,1,1,0
diff --git a/addons/payment/security/ir.model.access.csv b/addons/payment/security/ir.model.access.csv
index 76d11991b88..4737473135b 100644
--- a/addons/payment/security/ir.model.access.csv
+++ b/addons/payment/security/ir.model.access.csv
@@ -10,4 +10,6 @@ payment_method_portal,payment.token.portal,model_payment_token,base.group_portal
 payment_method_system,payment.token.system,model_payment_token,base.group_system,1,1,1,1
 payment_icon_all,payment.icon.all,model_payment_icon,,1,0,0,0
 payment_icon_user,payment.icon.user,model_payment_icon,base.group_user,1,1,1,0
-payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
\ No newline at end of file
+payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+access_payment_acquirer_onboarding_wizard,access.payment.acquirer.onboarding.wizard,model_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_payment_link_wizard,access.payment.link.wizard,model_payment_link_wizard,account.group_account_user,1,1,1,0
diff --git a/addons/point_of_sale/security/ir.model.access.csv b/addons/point_of_sale/security/ir.model.access.csv
index 76fe06de68d..1776a2e2ce2 100644
--- a/addons/point_of_sale/security/ir.model.access.csv
+++ b/addons/point_of_sale/security/ir.model.access.csv
@@ -40,3 +40,6 @@ access_decimal_precision_user,decimal.precision,base.model_decimal_precision,gro
 access_pos_payment_user,pos.payment user,model_pos_payment,group_pos_user,1,1,1,1

 access_pos_payment_method_user,pos.payment.method user,model_pos_payment_method,group_pos_user,1,0,0,0

 access_pos_payment_method_manager,pos.payment.method manager,model_pos_payment_method,group_pos_manager,1,1,1,1

+access_closing_balance_confirm_wizard,access.closing.balance.confirm.wizard,model_closing_balance_confirm_wizard,point_of_sale.group_pos_manager,0,0,0,0

+access_pos_details_wizard,access.pos.details.wizard,model_pos_details_wizard,point_of_sale.group_pos_manager,1,1,1,0

+access_pos_make_payment,access.pos.make.payment,model_pos_make_payment,point_of_sale.group_pos_manager,1,1,1,0

diff --git a/addons/portal/__manifest__.py b/addons/portal/__manifest__.py
index b2e9843f8ca..d396abdc6cd 100644
--- a/addons/portal/__manifest__.py
+++ b/addons/portal/__manifest__.py
@@ -17,6 +17,7 @@ of this module is to allow the display of a customer portal without having
 a dependency towards website edition and customization capabilities.""",
     'depends': ['web', 'web_editor', 'http_routing', 'mail', 'auth_signup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/portal_data.xml',
         'views/assets.xml',
         'views/portal_templates.xml',
diff --git a/addons/portal/security/ir.model.access.csv b/addons/portal/security/ir.model.access.csv
new file mode 100644
index 00000000000..6506676a9e5
--- /dev/null
+++ b/addons/portal/security/ir.model.access.csv
@@ -0,0 +1,4 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_portal_share","access.portal.share","model_portal_share","base.group_partner_manager",1,1,1,0
+"access_portal_wizard","access.portal.wizard","model_portal_wizard","base.group_partner_manager",1,1,1,0
+"access_portal_wizard_user","access.portal.wizard.user","model_portal_wizard_user","base.group_partner_manager",1,1,1,0
diff --git a/addons/portal/wizard/portal_wizard_views.xml b/addons/portal/wizard/portal_wizard_views.xml
index 05cf6714d3b..92f25c87811 100644
--- a/addons/portal/wizard/portal_wizard_views.xml
+++ b/addons/portal/wizard/portal_wizard_views.xml
@@ -5,8 +5,7 @@
             name="Grant portal access"
             binding_model="res.partner"
             res_model="portal.wizard"
-            view_mode="form" target="new"
-            groups="base.group_partner_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- wizard view -->
         <record id="wizard_view" model="ir.ui.view">
diff --git a/addons/product_expiry/__manifest__.py b/addons/product_expiry/__manifest__.py
index 4cb792f72f1..88356340cac 100644
--- a/addons/product_expiry/__manifest__.py
+++ b/addons/product_expiry/__manifest__.py
@@ -17,7 +17,8 @@ Following dates can be tracked:
 
 Also implements the removal strategy First Expiry First Out (FEFO) widely used, for example, in food industries.
 """,
-    'data': ['views/production_lot_views.xml',
+    'data': ['security/ir.model.access.csv',
+             'views/production_lot_views.xml',
              'views/product_template_views.xml',
              'views/stock_move_views.xml',
              'views/stock_quant_views.xml',
diff --git a/addons/product_expiry/security/ir.model.access.csv b/addons/product_expiry/security/ir.model.access.csv
new file mode 100644
index 00000000000..3996979a446
--- /dev/null
+++ b/addons/product_expiry/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_expiry_picking_confirmation","access.expiry.picking.confirmation","model_expiry_picking_confirmation","stock.group_stock_user",1,1,1,0
diff --git a/addons/product_margin/security/ir.model.access.csv b/addons/product_margin/security/ir.model.access.csv
index 4a08a4aa60d..81faf868345 100644
--- a/addons/product_margin/security/ir.model.access.csv
+++ b/addons/product_margin/security/ir.model.access.csv
@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_product_margin,access.product.margin,model_product_margin,account.group_account_user,1,1,1,0
diff --git a/addons/repair/security/ir.model.access.csv b/addons/repair/security/ir.model.access.csv
index eca832db8d3..71d03880f13 100644
--- a/addons/repair/security/ir.model.access.csv
+++ b/addons/repair/security/ir.model.access.csv
@@ -5,3 +5,6 @@ access_repair_tag_user,Repair Tags user,model_repair_tags,stock.group_stock_user
 access_stock_production_lot_user,stock.production.lot user,stock.model_stock_production_lot,stock.group_stock_user,1,1,1,1
 access_repair_line_user,repair.line user,model_repair_line,stock.group_stock_user,1,1,1,1
 access_account_tax_user,account.tax,account.model_account_tax,stock.group_stock_user,1,1,1,1
+access_repair_cancel,access.repair.cancel,model_repair_cancel,stock.group_stock_user,1,1,1,0
+access_repair_order_make_invoice,access.repair.order.make_invoice,model_repair_order_make_invoice,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_repair,access.stock.warn.insufficient.qty.repair,model_stock_warn_insufficient_qty_repair,stock.group_stock_user,1,1,1,0
diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv
index 3dec3d9c007..d3bc9376ed8 100644
--- a/addons/sale/security/ir.model.access.csv
+++ b/addons/sale/security/ir.model.access.csv
@@ -55,3 +55,7 @@ access_account_tax_group_sale_manager,account.tax.group sale manager,account.mod
 access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0

 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1

 access_report_all_channels_sales,access_report_all_channels_sales,model_report_all_channels_sales,sales_team.group_sale_manager,1,0,0,0

+access_sale_payment_acquirer_onboarding_wizard,access.sale.payment.acquirer.onboarding.wizard,model_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0

+access_sale_advance_payment_inv,access.sale.advance.payment.inv,model_sale_advance_payment_inv,sales_team.group_sale_salesman,1,1,1,0

+access_sale_order_cancel,access.sale.order.cancel,model_sale_order_cancel,sales_team.group_sale_salesman,1,1,1,0

+access_payment_link_wizard_sale,access.payment.link.wizard.sale,model_payment_link_wizard,sales_team.group_sale_salesman,1,1,1,0

diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml
index bd0508e1ef7..942844709e1 100644
--- a/addons/sale/security/sale_security.xml
+++ b/addons/sale/security/sale_security.xml
@@ -187,5 +187,27 @@
         <field name="domain_force">[('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
+    
+    <!-- Wizard access rules -->
+    <record id="sale_payment_acquirer_onboarding_wizard_rule" model="ir.rule">
+        <field name="name">Payment Acquier Onboarding Wizard Rule</field>
+        <field name="model_id" ref="model_sale_payment_acquirer_onboarding_wizard"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_advance_payment_inv_rule" model="ir.rule">
+        <field name="name">Sales Advance Payment Invoice Rule</field>
+        <field name="model_id" ref="model_sale_advance_payment_inv"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_order_cancel_rule" model="ir.rule">
+        <field name="name">Sales Order Cancel Rule</field>
+        <field name="model_id" ref="model_sale_order_cancel"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
 </data>
 </odoo>
diff --git a/addons/sale/wizard/sale_make_invoice_advance_views.xml b/addons/sale/wizard/sale_make_invoice_advance_views.xml
index 5af37ef6a24..3dd0a99cec0 100644
--- a/addons/sale/wizard/sale_make_invoice_advance_views.xml
+++ b/addons/sale/wizard/sale_make_invoice_advance_views.xml
@@ -56,7 +56,6 @@
             <field name="res_model">sale.advance.payment.inv</field>
             <field name="view_mode">form</field>
             <field name="target">new</field>
-            <field name="groups_id" eval="[(4,ref('sales_team.group_sale_salesman'))]"/>
             <!-- TODO: check if we need this -->
             <field name="binding_model_id" ref="sale.model_sale_order" />
             <field name="binding_view_types">list</field>
diff --git a/addons/sale_coupon/__manifest__.py b/addons/sale_coupon/__manifest__.py
index 59e0d22d6f5..c731a4d1b0b 100644
--- a/addons/sale_coupon/__manifest__.py
+++ b/addons/sale_coupon/__manifest__.py
@@ -8,6 +8,7 @@
     'version': '1.0',
     'depends': ['sale_management'],
     'data': [
+        'security/sale_coupon_security.xml',
         'security/ir.model.access.csv',
         'wizard/sale_coupon_apply_code_views.xml',
         'wizard/sale_coupon_generate_views.xml',
diff --git a/addons/sale_coupon/security/ir.model.access.csv b/addons/sale_coupon/security/ir.model.access.csv
index 18ec5bda7ae..265de7613e9 100644
--- a/addons/sale_coupon/security/ir.model.access.csv
+++ b/addons/sale_coupon/security/ir.model.access.csv
@@ -7,3 +7,5 @@ access_coupon_salesman,salesman,model_sale_coupon,sales_team.group_sale_salesman
 access_coupon_manager,program manager,model_sale_coupon,sales_team.group_sale_manager,1,1,1,0
 access_reward_salesman,salesman,model_sale_coupon_reward,sales_team.group_sale_salesman,1,0,0,0
 access_reward_manager,program manager,model_sale_coupon_reward,sales_team.group_sale_manager,1,1,1,0
+access_sale_coupon_apply_code,access.sale.coupon.apply.code,model_sale_coupon_apply_code,sales_team.group_sale_salesman,1,1,1,0
+access_sale_coupon_generate,access.sale.coupon.generate,model_sale_coupon_generate,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_coupon/security/sale_coupon_security.xml b/addons/sale_coupon/security/sale_coupon_security.xml
new file mode 100644
index 00000000000..fa5b89ef5ef
--- /dev/null
+++ b/addons/sale_coupon/security/sale_coupon_security.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+<data noupdate="1">
+
+    <record id="sale_coupon_apply_code_rule" model="ir.rule">
+        <field name="name">Sale Coupon Apply Code Rule</field>
+        <field name="model_id" ref="model_sale_coupon_apply_code"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+    <record id="sale_coupon_generate_rule" model="ir.rule">
+        <field name="name">Generate Sales Coupon Rule</field>
+        <field name="model_id" ref="model_sale_coupon_generate"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+</data>
+</odoo>
diff --git a/addons/sale_crm/security/ir.model.access.csv b/addons/sale_crm/security/ir.model.access.csv
index 75317a244ad..7751d54565c 100644
--- a/addons/sale_crm/security/ir.model.access.csv
+++ b/addons/sale_crm/security/ir.model.access.csv
@@ -1,2 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

-

+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_crm_quotation_partner,access.crm.quotation.partner,model_crm_quotation_partner,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_product_configurator/__manifest__.py b/addons/sale_product_configurator/__manifest__.py
index 5211fcaf4e7..c24fa65c12a 100644
--- a/addons/sale_product_configurator/__manifest__.py
+++ b/addons/sale_product_configurator/__manifest__.py
@@ -15,6 +15,7 @@ It also enables the "optional products" feature.
 
     'depends': ['sale'],
     'data': [
+        'security/ir.model.access.csv',
         'views/assets.xml',
         'views/templates.xml',
         'views/sale_views.xml',
diff --git a/addons/sale_product_configurator/security/ir.model.access.csv b/addons/sale_product_configurator/security/ir.model.access.csv
new file mode 100644
index 00000000000..1c8e002cafd
--- /dev/null
+++ b/addons/sale_product_configurator/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sale_product_configurator","access.sale.product.configurator","model_sale_product_configurator","sales_team.group_sale_salesman",1,1,1,0
diff --git a/addons/sale_timesheet/security/ir.model.access.csv b/addons/sale_timesheet/security/ir.model.access.csv
index 371bd9a61e3..74e49f82654 100644
--- a/addons/sale_timesheet/security/ir.model.access.csv
+++ b/addons/sale_timesheet/security/ir.model.access.csv
@@ -2,3 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_project_profitability_report_analysis_manager,project.profitability.report.analysis,model_project_profitability_report,project.group_project_manager,1,1,1,1
 access_project_sale_line_employee_map,access_project_sale_line_employee_map,model_project_sale_line_employee_map,base.group_user,1,0,0,0
 access_project_sale_line_employee_map_manager,access_project_sale_line_employee_map_project_manager,model_project_sale_line_employee_map,project.group_project_manager,1,1,1,1
+access_project_create_sale_order,access.project.create.sale.order,model_project_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_sale_order_line,access.project.create.sale.order.line,model_project_create_sale_order_line,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_invoice,access.project.create.invoice,model_project_create_invoice,sales_team.group_sale_salesman_all_leads,1,1,1,0
+access_project_task_create_sale_order,access.project.task.create.sale.order,model_project_task_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_timesheet/wizard/project_create_invoice_views.xml b/addons/sale_timesheet/wizard/project_create_invoice_views.xml
index 191cab2c0c4..55e2bdff034 100644
--- a/addons/sale_timesheet/wizard/project_create_invoice_views.xml
+++ b/addons/sale_timesheet/wizard/project_create_invoice_views.xml
@@ -26,7 +26,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_invoice_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
index db90b4b5402..a4a01bf2efa 100644
--- a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
+++ b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
@@ -49,7 +49,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
index ec580dda564..7723545d87f 100644
--- a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
+++ b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
@@ -31,7 +31,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_task_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sms/security/ir.model.access.csv b/addons/sms/security/ir.model.access.csv
index b5c75f2433f..bf54348054c 100644
--- a/addons/sms/security/ir.model.access.csv
+++ b/addons/sms/security/ir.model.access.csv
@@ -4,3 +4,8 @@ access_sms_sms_system,access.sms.sms.system,model_sms_sms,base.group_system,1,1,
 access_sms_template_all,access.sms.template.all,model_sms_template,,0,0,0,0
 access_sms_template_user,access.sms.template.user,model_sms_template,base.group_user,1,0,0,0
 access_sms_template_system,access.sms.template.system,model_sms_template,base.group_system,1,1,1,1
+access_sms_cancel,access.sms.cancel,model_sms_cancel,base.group_user,1,1,1,0
+access_sms_composer,access.sms.composer,model_sms_composer,base.group_user,1,1,1,0
+access_sms_resend_recipient,access.sms.resend.recipient,model_sms_resend_recipient,base.group_user,1,1,1,0
+access_sms_resend,access.sms.resend,model_sms_resend,base.group_user,1,1,1,0
+access_sms_template_preview,access.sms.template.preview,model_sms_template_preview,base.group_user,1,1,1,0
diff --git a/addons/snailmail/security/ir.model.access.csv b/addons/snailmail/security/ir.model.access.csv
index 3c111854063..c0bf2882c6d 100644
--- a/addons/snailmail/security/ir.model.access.csv
+++ b/addons/snailmail/security/ir.model.access.csv
@@ -2,4 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_snailmail_letter_all,snailmail.letter.all,model_snailmail_letter,,1,0,0,0
 access_snailmail_letter_portal,snailmail.letter.portal,model_snailmail_letter,base.group_portal,1,0,1,0
 access_snailmail_letter_user,snailmail.letter.user,model_snailmail_letter,base.group_user,1,1,1,0
-access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
\ No newline at end of file
+access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_cancel,access.snailmail.letter.cancel,model_snailmail_letter_cancel,base.group_user,1,1,1,0
+access_snailmail_letter_format_error,access.snailmail.letter.format.error,model_snailmail_letter_format_error,base.group_user,1,1,1,0
+access_snailmail_letter_missing_required_fields,access.snailmail.letter.missing.required.fields,model_snailmail_letter_missing_required_fields,base.group_user,1,1,1,0
diff --git a/addons/stock/security/ir.model.access.csv b/addons/stock/security/ir.model.access.csv
index 596ac22548c..3b177eb51a0 100644
--- a/addons/stock/security/ir.model.access.csv
+++ b/addons/stock/security/ir.model.access.csv
@@ -72,3 +72,20 @@ access_product_product_attribute_manager,product.product.attribute manager value
 access_product_template_attribute_exclusion_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,stock.group_stock_manager,1,1,1,1
 access_product_template_attribute_line_manager,product.attribute manager line,product.model_product_template_attribute_line,stock.group_stock_manager,1,1,1,1
 access_report_stock_quantity,access_report_stock_quantity,model_report_stock_quantity,base.group_user,1,0,0,0
+access_stock_traceability_report,access.stock.traceability.report,model_stock_traceability_report,stock.group_stock_user,1,1,1,0
+access_stock_assign_serial,access.stock.assign.serial,model_stock_assign_serial,stock.group_stock_user,1,1,1,0
+access_stock_return_picking_line,access.stock.return.picking.line,model_stock_return_picking_line,stock.group_stock_user,1,1,1,0
+access_stock_return_picking,access.stock.return.picking,model_stock_return_picking,stock.group_stock_user,1,1,1,0
+access_stock_change_product_qty,access.stock.change.product.qty,model_stock_change_product_qty,stock.group_stock_user,1,1,1,0
+access_stock_scheduler_compute,access.stock.scheduler.compute,model_stock_scheduler_compute,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer_line,access.stock.immediate.transfer.line,model_stock_immediate_transfer_line,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer,access.stock.immediate.transfer,model_stock_immediate_transfer,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation_line,access.stock.backorder.confirmation.line,model_stock_backorder_confirmation_line,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation,access.stock.backorder.confirmation,model_stock_backorder_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_quantity_history,access.stock.quantity.history,model_stock_quantity_history,stock.group_stock_user,1,1,1,0
+access_stock_rules_report,access.stock.rules.report,model_stock_rules_report,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_scrap,access.stock.warn.insufficient.qty.scrap,model_stock_warn_insufficient_qty_scrap,stock.group_stock_user,1,1,1,0
+access_product_replenish,access.product.replenish,model_product_replenish,stock.group_stock_user,1,1,1,0
+access_stock_track_confirmation,access.stock.track.confirmation,model_stock_track_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_track_line,access.stock.track.line,model_stock_track_line,stock.group_stock_user,1,1,1,0
+access_stock_package_destination,access.stock.package.destination,model_stock_package_destination,stock.group_stock_user,1,1,1,0
diff --git a/addons/stock_picking_batch/security/ir.model.access.csv b/addons/stock_picking_batch/security/ir.model.access.csv
index 615ed649f59..31a6de03836 100644
--- a/addons/stock_picking_batch/security/ir.model.access.csv
+++ b/addons/stock_picking_batch/security/ir.model.access.csv
@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_stock_picking_batch,stock.picking.batch stock users,model_stock_picking_batch,stock.group_stock_user,1,1,1,1
+access_stock_picking_to_batch,access.stock.picking.to.batch,model_stock_picking_to_batch,stock.group_stock_user,1,1,1,0
diff --git a/addons/stock_sms/security/ir.model.access.csv b/addons/stock_sms/security/ir.model.access.csv
index 70870ff6dbf..822806bbe5c 100644
--- a/addons/stock_sms/security/ir.model.access.csv
+++ b/addons/stock_sms/security/ir.model.access.csv
@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_sms_template_stock_manager,access.sms.template.stock.manager,sms.model_sms_template,stock.group_stock_manager,1,1,1,1
+access_confirm_stock_sms,access.confirm.stock.sms,model_confirm_stock_sms,stock.group_stock_user,1,1,1,0
diff --git a/addons/survey/security/ir.model.access.csv b/addons/survey/security/ir.model.access.csv
index 89cce9edfc5..39fec6457fd 100644
--- a/addons/survey/security/ir.model.access.csv
+++ b/addons/survey/security/ir.model.access.csv
@@ -20,3 +20,4 @@ access_survey_user_input_line_user,survey.user_input.line.user,model_survey_user
 access_survey_user_input_line_survey_user,survey.user_input.line.survey.user,model_survey_user_input_line,group_survey_user,1,1,1,1
 access_survey_user_input_line_survey_manager,survey.user_input.line.survey.manager,model_survey_user_input_line,group_survey_manager,1,1,1,1
 access_gamification_badge_survey_user,gamification.badge.survey.user,model_gamification_badge,group_survey_user,1,1,1,1
+access_survey_invite,access.survey.invite,model_survey_invite,survey.group_survey_user,1,1,1,0
diff --git a/addons/test_mail/tests/test_performance.py b/addons/test_mail/tests/test_performance.py
index 6cdc637ccf3..31c93f4a0fa 100644
--- a/addons/test_mail/tests/test_performance.py
+++ b/addons/test_mail/tests/test_performance.py
@@ -277,8 +277,8 @@ class TestMailAPIPerformance(BaseMailPerformance):
     def test_mail_composer_w_template(self):
         test_record = self.env['mail.test.full'].browse(self.test_record_full.id)
         test_template = self.env['mail.template'].browse(self.test_template_full.id)
-        # TODO XDO/TDE FIXME non deterministic between 25 and 28 queries
-        with self.assertQueryCount(__system__=28, emp=28):
+        # TODO XDO/TDE/MAT FIXME non deterministic between 25 and 29 queries
+        with self.assertQueryCount(__system__=28, emp=29):
             composer = self.env['mail.compose.message'].with_context({
                 'default_composition_mode': 'comment',
                 'default_model': test_record._name,
@@ -489,7 +489,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         record = self.umbrella.with_user(self.env.user)
         template_id = self.env.ref('test_mail.mail_test_tpl').id
 
-        with self.assertQueryCount(__system__=84, emp=85):
+        with self.assertQueryCount(__system__=84, emp=86):
             record.message_post_with_template(template_id, message_type='comment', composition_mode='comment')
 
         self.assertEqual(record.message_ids[0].body, '<p>Adding stuff on %s</p>' % record.name)
@@ -680,7 +680,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         rec1 = rec.with_context(active_test=False)      # to see inactive records
         self.assertEqual(rec1.message_partner_ids, self.partners | self.env.user.partner_id | self.user_portal.partner_id)
 
-        with self.assertQueryCount(__system__=34, emp=35):
+        with self.assertQueryCount(__system__=34, emp=36):
             rec.write({
                 'name': 'Test2',
                 'customer_id': customer_id,
diff --git a/addons/website/security/ir.model.access.csv b/addons/website/security/ir.model.access.csv
index 1053d765d0f..daa7630f376 100644
--- a/addons/website/security/ir.model.access.csv
+++ b/addons/website/security/ir.model.access.csv
@@ -21,3 +21,4 @@ access_theme_ir_ui_view,access_theme_ir_ui_view,model_theme_ir_ui_view,base.grou
 access_theme_ir_attachment,access_theme_ir_attachment,model_theme_ir_attachment,base.group_system,1,1,1,1
 access_theme_website_menu,access_theme_website_menu,model_theme_website_menu,base.group_system,1,1,1,1
 access_theme_website_page,access_theme_website_page,model_theme_website_page,base.group_system,1,1,1,1
+access_website_robots,access.website.robots,model_website_robots,website.group_website_designer,1,1,1,0
diff --git a/addons/website_crm_partner_assign/security/ir.model.access.csv b/addons/website_crm_partner_assign/security/ir.model.access.csv
index c400f632eee..3e07ee84ae2 100644
--- a/addons/website_crm_partner_assign/security/ir.model.access.csv
+++ b/addons/website_crm_partner_assign/security/ir.model.access.csv
@@ -10,3 +10,5 @@ access_partner_activation_manager,res.partner.activation.manager,model_res_partn
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment_readonly,res.partner.grade,model_res_partner_grade,account.group_account_readonly,1,0,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
+access_crm_lead_forward_to_partner,access.crm.lead.forward.to.partner,model_crm_lead_forward_to_partner,sales_team.group_sale_manager,1,1,1,0
+access_crm_lead_assignation,access.crm.lead.assignation,model_crm_lead_assignation,sales_team.group_sale_manager,1,1,1,0
diff --git a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
index 20efa652097..a86faea87c7 100644
--- a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
+++ b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
@@ -48,7 +48,6 @@
             name="Forward to partner" res_model="crm.lead.forward.to.partner"
             binding_model="crm.lead"
             view_mode="form" target="new"
-            groups="sales_team.group_sale_manager"
             context="{'default_composition_mode' : 'mass_mail'}" view_id="crm_lead_forward_to_partner_form" />
 
 </odoo>
diff --git a/addons/website_sale/security/ir.model.access.csv b/addons/website_sale/security/ir.model.access.csv
index 6da9fe3be19..625480f9611 100644
--- a/addons/website_sale/security/ir.model.access.csv
+++ b/addons/website_sale/security/ir.model.access.csv
@@ -21,3 +21,4 @@ access_account_tax_user,account.tax,account.model_account_tax,base.group_public,
 access_product_image_public,product.image public,model_product_image,,1,0,0,0
 access_product_image_publisher,product.image wbesite publisher,model_product_image,website.group_website_publisher,1,1,1,1
 access_product_image_sale,product.image sale,model_product_image,sales_team.group_sale_manager,1,1,1,1
+access_website_sale_payment_acquirer_onboarding_wizard,access.website.sale.payment.acquirer.onboarding.wizard,model_website_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
diff --git a/addons/website_slides/security/ir.model.access.csv b/addons/website_slides/security/ir.model.access.csv
index 43f14a23bbf..355ebc5ade4 100644
--- a/addons/website_slides/security/ir.model.access.csv
+++ b/addons/website_slides/security/ir.model.access.csv
@@ -26,3 +26,4 @@ access_slide_slide_link_officer,slide.slide.link.officer,model_slide_slide_link,
 access_slide_slide_resource_all,slide.slide.resource.all,model_slide_slide_resource,,1,0,0,0
 access_slide_slide_resource_public,slide.slide.resource.public,model_slide_slide_resource,base.group_public,0,0,0,0
 access_slide_slide_resource_publisher,slide.slide.resource.publisher,model_slide_slide_resource,website_slides.group_website_slides_officer,1,1,1,1
+access_slide_channel_invite,access.slide.channel.invite,model_slide_channel_invite,base.group_user,1,1,1,0
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index 444f0148ada..f3ee7bb6cbc 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -68,6 +68,12 @@
             <field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="change_password_rule" model="ir.rule">
+            <field name="name">change user password rule</field>
+            <field name="model_id" ref="model_change_password_user"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+        </record>
+
         <!-- Security restriction for private addresses -->
         <record id="res_partner_rule_private_employee" model="ir.rule">
             <field name="name">res.partner.rule.private.employee</field>
diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv
index e1d6785f006..211e9d5485c 100644
--- a/odoo/addons/base/security/ir.model.access.csv
+++ b/odoo/addons/base/security/ir.model.access.csv
@@ -99,3 +99,23 @@
 "paperformat_access_portal","ir_actions_report_paperformat group_portal","model_report_paperformat",,1,0,0,0
 "paperformat_access_employee","ir_actions_report_paperformat group_system","model_report_paperformat",group_system,1,1,1,1
 "access_report_layout","access_report_layout","model_report_layout",,1,1,1,1
+"access_wizard_ir_model_menu_create","access.wizard.ir.model.menu.create","model_wizard_ir_model_menu_create","base.group_system",1,1,1,0
+"access_reset_view_arch_wizard","access.reset.view.arch.wizard","model_reset_view_arch_wizard","base.group_erp_manager",1,1,1,0
+"access_ir_demo","access.ir.demo","model_ir_demo","base.group_system",1,1,1,0
+"access_ir_demo_failure","access.ir.demo_failure","model_ir_demo_failure","base.group_system",1,1,1,0
+"access_ir_demo_failure_wizard","access.ir.demo_failure.wizard","model_ir_demo_failure_wizard","base.group_system",1,1,1,0
+"access_res_config","access.res.config","model_res_config","base.group_system",1,1,1,0
+"access_res_config_installer","access.res.config.installer","model_res_config_installer","base.group_system",1,1,1,0
+"access_res_config_settings","access.res.config.settings","model_res_config_settings","base.group_system",1,1,1,0
+"access_change_password_wizard","access.change.password.wizard","model_change_password_wizard","base.group_erp_manager",1,1,1,0
+"access_change_password_user","access.change.password.user","model_change_password_user","base.group_system",1,1,1,0
+"access_base_module_update","access.base.module.update","model_base_module_update","base.group_system",1,1,1,0
+"access_base_language_install","access.base.language.install","model_base_language_install","base.group_system",1,1,1,0
+"access_base_language_import","access.base.language.import","model_base_language_import","base.group_system",1,1,1,0
+"access_base_module_upgrade","access.base.module.upgrade","model_base_module_upgrade","base.group_system",1,1,1,0
+"access_base_module_uninstall","access.base.module.uninstall","model_base_module_uninstall","base.group_system",1,1,1,0
+"access_base_language_export","access.base.language.export","model_base_language_export","base.group_user",1,1,1,0
+"access_base_update_translations","access.base.update.translations","model_base_update_translations","base.group_system",1,1,1,0
+"access_base_partner_merge_line","access.base.partner.merge.line","model_base_partner_merge_line","base.group_system",1,1,1,0
+"access_base_partner_merge_automatic_wizard","access.base.partner.merge.automatic.wizard","model_base_partner_merge_automatic_wizard","base.group_system",1,1,1,0
+"access_base_document_layout","access.base.document.layout","model_base_document_layout","base.group_system",1,1,1,0
diff --git a/odoo/addons/base/views/ir_ui_view_views.xml b/odoo/addons/base/views/ir_ui_view_views.xml
index 594561a39f9..45b95be604c 100644
--- a/odoo/addons/base/views/ir_ui_view_views.xml
+++ b/odoo/addons/base/views/ir_ui_view_views.xml
@@ -129,8 +129,7 @@
             binding_model="ir.ui.view" binding_views="form"
             res_model="reset.view.arch.wizard"
             view_mode="form"
-            target="new"
-            groups="base.group_erp_manager"/>
+            target="new"/>
 
         <!-- View customizations -->
         <record id="view_view_custom_form" model="ir.ui.view">
diff --git a/odoo/addons/base/views/res_users_views.xml b/odoo/addons/base/views/res_users_views.xml
index 50008ead434..bc08c1ec562 100644
--- a/odoo/addons/base/views/res_users_views.xml
+++ b/odoo/addons/base/views/res_users_views.xml
@@ -31,8 +31,7 @@
             name="Change Password"
             binding_model="res.users"
             res_model="change.password.wizard"
-            view_mode="form" target="new"
-            groups="base.group_erp_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- res.groups -->
         <record id="view_groups_search" model="ir.ui.view">
diff --git a/odoo/addons/test_new_api/security/ir.model.access.csv b/odoo/addons/test_new_api/security/ir.model.access.csv
index 5a4f8ce3239..056be62d064 100644
--- a/odoo/addons/test_new_api/security/ir.model.access.csv
+++ b/odoo/addons/test_new_api/security/ir.model.access.csv
@@ -48,3 +48,4 @@ access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new
 access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1
 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1
 access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1
+access_test_new_api_req_m2o_transient,access_test_new_api_req_m2o_transient,model_test_new_api_req_m2o_transient,,0,0,0,0
diff --git a/odoo/addons/test_translation_import/__manifest__.py b/odoo/addons/test_translation_import/__manifest__.py
index 73a0c450032..c6de7e12509 100644
--- a/odoo/addons/test_translation_import/__manifest__.py
+++ b/odoo/addons/test_translation_import/__manifest__.py
@@ -5,7 +5,10 @@
     'category': 'Tests',
     'description': """A module to test translation import.""",
     'depends': ['base'],
-    'data': ['view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'view.xml'
+    ],
     'installable': True,
     'auto_install': False,
 }
diff --git a/odoo/addons/test_translation_import/security/ir.model.access.csv b/odoo/addons/test_translation_import/security/ir.model.access.csv
new file mode 100644
index 00000000000..ba076d4035f
--- /dev/null
+++ b/odoo/addons/test_translation_import/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_test_translation_import","access.test.translation.import","model_test_translation_import",,0,0,0,0