diff --git a/soong_workflow/models/soong_workflow_record.py b/soong_workflow/models/soong_workflow_record.py
index b9de1f3a9..6c1685a28 100644
--- a/soong_workflow/models/soong_workflow_record.py
+++ b/soong_workflow/models/soong_workflow_record.py
@@ -655,18 +655,21 @@ class SoongWorkflowRecord(models.Model):
         is_kq_user = bool(kq_group and user in kq_group.users)
         company_ids = self.env.companies.ids
 
-        conditions = []
+        # 注意：必须用扁平前缀形式（&/| 放在 domain 顶层），
+        # 不能把 ['&', ...] 作为子列表元素，否则 Odoo 会把它当叶子、把 & 当成字段名报错。
+        parts = []
         if is_hr_user:
-            conditions.append(['&', ('approvals_group_id.name', '=', '人事'), ('company_id', 'in', company_ids)])
+            parts.append(['&', ('approvals_group_id.name', '=', '人事'), ('company_id', 'in', company_ids)])
         if is_kq_user:
-            conditions.append(['&', ('approvals_group_id.name', '=', '考勤'), ('company_id', 'in', company_ids)])
+            parts.append(['&', ('approvals_group_id.name', '=', '考勤'), ('company_id', 'in', company_ids)])
 
-        if not conditions:
+        if not parts:
             # 当前用户不属于任何特殊权限组，恒不满足
             domain = [('id', '=', False)]
         else:
-            domain = ['|'] * (len(conditions) - 1)
-            domain += conditions
+            domain = ['|'] * (len(parts) - 1)
+            for grp in parts:
+                domain += grp
 
         if (operator == '=' and not value) or (operator == '!=' and value):
             domain = ['!'] + domain