title: odoo record rule AccessError
body: <p><strong>Initial data:</strong></p>
  
  <ol>
  <li>system: odoo v8, ubuntu 14.04</li>
  <li>module: remake</li>
  </ol>
  
  <blockquote>
    <p>remake/<strong>openerp</strong>.py >> <strong>successfull</strong></p>
  </blockquote>
  
  <pre><code># -*- coding: utf-8 -*-
  {
      'name': 'Remake',
      'version': '1.0.1',
      'author': 'BZ Group',
      'category': 'System',
      'sequence': 8,
      'depends': [
          'base',
          'account',
          'project', 
          'account_analytic_analysis'
      ],
      'data': [
          'security/remake_security.xml',
          'security/ir.model.access.csv',
      ],
      'installable': True,
      'application': True,
      'post_init_hook': 'set_account_analytic_account_project_id',
  }
  </code></pre>
  
  <blockquote>
    <p>remake/<strong>init</strong>.py >> <strong>successfull</strong></p>
  </blockquote>
  
  <pre><code># -*- coding: utf-8 -*-
  from . import account_analytic_project_id
  from .post_install import set_account_analytic_account_project_id
  </code></pre>
  
  <blockquote>
    <p>remake/account_analytic_project_id.py >> <strong>successfull</strong></p>
  </blockquote>
  
  <pre><code># -*- coding: utf-8 -*-
  
  from openerp import fields, models, api
  
  class AccountAnalyticAccount(models.Model):
      _inherit = 'account.analytic.account'
  
      project_id = fields.Many2one(
          'project.project', 'Project', copy=False,
          index=True)
  
  
  class ProjectProject(models.Model):
      _name = 'project.project'
      _inherit = 'project.project'
  
      @api.model
      @api.returns('self', lambda value: value.id)
      def create(self, vals):
          project = super(ProjectProject, self).create(vals)
          project.analytic_account_id.sudo().write({'project_id': project.id})
          return project
  </code></pre>
  
  <blockquote>
    <p>remake/post_install.py >> <strong>successfull</strong></p>
  </blockquote>
  
  <pre><code>def set_account_analytic_account_project_id(cr, pool):
      '''
          Initialize the project_id field in case the module is
          installed when projects already exist
      '''
      cr.execute("""
              update account_analytic_account
                  set project_id = (select id
                      from project_project where
                      analytic_account_id = account_analytic_account.id)
          """)
      return
  </code></pre>
  
  <blockquote>
    <p>remake/security/ir.model.access.csv >> <strong>successfull</strong></p>
  </blockquote>
  
  <pre><code>id,                     name,                   model_id:id,                                                    group_id:id,perm_read,perm_write,perm_create,perm_unlink
  remake_g4_pr_pr,        remake_g4_pr.pr,        project.model_project_project,                                  remake.remake_g4,1,0,0,0
  remake_g4_ac_an_in_ln,  remake_g4_ac.an.in.ln,  account_analytic_analysis.model_account_analytic_invoice_line,  remake.remake_g4,1,0,0,0
  remake_g4_ac_an_ac,     remake_g4_ac.an.ac,     analytic.model_account_analytic_account,                        remake.remake_g4,1,0,0,0
  remake_g4_ac_ac,        remake_g4_ac.ac,        account.model_account_account,                                  remake.remake_g4,1,0,0,0
  remake_g4_pr_ac_an_ln,  remake_g4_pr.ac.an.ln,  account.model_project_account_analytic_line,                    remake.remake_g4,1,0,0,0
  remake_g4_ac_in,        remake_g4_ac.in,        account.model_account_invoice,                                  remake.remake_g4,1,0,0,0
  remake_g4_ac_in_ln,     remake_g4_ac.in.ln,     account.model_account_invoice_line,                             remake.remake_g4,1,0,0,0
  </code></pre>
  
  <blockquote>
    <p>remake/security/remake_security.xml >> <strong>need help: remake_g4_rule_account</strong></p>
  </blockquote>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt; 
  - &lt;openerp&gt;
  - &lt;data noupdate="0"&gt;
  
  - &lt;record id="remake_group_category" model="ir.module.category"&gt;
    &lt;field name="name"&gt;Remake&lt;/field&gt; 
    &lt;/record&gt;
  
  - &lt;record id="remake_g4" model="res.groups"&gt;
    &lt;field name="name"&gt;Security Group IV&lt;/field&gt; 
    &lt;field name="implied_ids" eval="[(4, ref('base.group_user'))]" /&gt; 
    &lt;field name="category_id" ref="remake_group_category" /&gt; 
   &lt;/record&gt;
  
  
    &lt;delete model="ir.rule" id="project.task_visibility_rule" /&gt; 
    &lt;delete model="ir.rule" id="project.project_public_members_rule" /&gt; 
  
  - &lt;record model="ir.rule" id="remake_g4_rule_project"&gt;
    &lt;field name="name"&gt;Remake group 4 project, member or follower: read&lt;/field&gt; 
    &lt;field name="model_id" ref="project.model_project_project" /&gt; 
    &lt;field name="domain_force"&gt;[ '|', '&amp;', ('privacy_visibility', '=', 'employees'), ('members','in',[user.id]), '&amp;', ('privacy_visibility', '=', 'followers'), ('message_follower_ids', 'in', [user.partner_id.id])]&lt;/field&gt; 
    &lt;field name="groups" eval="[(6,0,[ref('remake_g4')])]" /&gt; 
    &lt;field name="global" eval="False" /&gt; 
    &lt;field name="perm_read" eval="True" /&gt; 
    &lt;field name="perm_write" eval="False" /&gt; 
    &lt;field name="perm_create" eval="False" /&gt; 
    &lt;field name="perm_unlink" eval="False" /&gt; 
    &lt;/record&gt;
  
  - &lt;!--  If uncomment this rule &gt;&gt; raise AccessError    
  - &lt;record model="ir.rule" id="remake_g4_rule_account"&gt;
    &lt;field name="name"&gt;Remake group 4 account, member or follower: read&lt;/field&gt; 
    &lt;field name="model_id" ref="analytic.model_account_analytic_account" /&gt; 
    &lt;field name="domain_force"&gt;[ '|', '&amp;', ('project_id.privacy_visibility', '=', 'employees'), ('project_id.members','in',[user.id]), '&amp;', ('project_id.privacy_visibility', '=', 'followers'), ('project_id.message_follower_ids', 'in', [user.partner_id.id])]&lt;/field&gt; 
    &lt;field name="groups" eval="[(6,0,[ref('remake_g4')])]" /&gt; 
    &lt;field name="global" eval="False" /&gt; 
    &lt;field name="perm_read" eval="True" /&gt; 
    &lt;field name="perm_write" eval="False" /&gt; 
    &lt;field name="perm_create" eval="False" /&gt; 
    &lt;field name="perm_unlink" eval="False" /&gt; 
    &lt;/record&gt; --&gt;
   &lt;/data&gt;
  &lt;/openerp&gt;
  </code></pre>
  
  <hr>
  
  <blockquote>
    <p>When move to Sales > Contracts:</p>
    
    <p><strong>RESULT:</strong>  AccessError, The requested operation cannot be completed to security restriction. Please contact your system
    administrator.(Document type: account.analytic.account, Operation:
    read)</p>
  </blockquote>