title: Record Rule to allow a User to update their own Employee record without belonging to Officer group
body: <p>I am trying to define a Record Rule within OpenERP 7.0 that allows a User who is not in the Officer group to change their own Employee record only, while still keeping the existing global rule allowing users in the Officer group full rights. I've gotten as far as setting up a custom rule with the following details:</p>
  
  <ul>
  <li>Name: User_edit_own_employee_rule</li>
  <li>Object: Employee</li>
  <li>Apply for Read: checked</li>
  <li>Apply for Write: checked</li>
  <li>Rule Definition: <code>[('user_id', '=', user.id)]</code></li>
  </ul>
  
  <p>However, all this seems to do is remove the ability of the User to read any Employee record except for their own. As far as I can tell, I need to combine this rule with a logical OR operator with Group rule applying to users in the Officer group. Can anyone give me any pointers for how to accomplish this?</p>
  
  <p><em>Edit</em>: My desired behaviour is thus:</p>
  
  <ul>
  <li>All users (<strong>Employee</strong> group) can search and read all Employee records.</li>
  <li>Users in the <strong>Employee</strong> group can edit their own Employee record, but not others.</li>
  <li>Users in the <strong>Officer</strong> group can edit all Employee records (this is default behaviour for the HR module).</li>
  </ul>
  
  <p>Tried thus far:</p>
  
  <ul>
  <li>Modify the Record Rule described above (User_edit_own_employee_rule) to apply only for Write operations, not Read operations (users can see all Employee records, but not edit any records including their own).</li>
  <li>Modify the <strong>hr.employee system user</strong> Access Control rule to allow Write operations (users can now edit all Employee records).</li>
  </ul>
  
  <p>One clue I have is that, using the API to return an employee's user_id in the shell, OpenERP returns <code>[5, 'Joe Bloggs']</code>. I wonder whether my Record Rule is querying the foreign key relationship properly?</p>