diff --git a/addons/lunch/security/lunch_security.xml b/addons/lunch/security/lunch_security.xml
index e01fab71ea2..5f2a351472c 100644
--- a/addons/lunch/security/lunch_security.xml
+++ b/addons/lunch/security/lunch_security.xml
@@ -16,5 +16,43 @@
             <field name="category_id" ref="module_lunch_category"/>
             <field name="users" eval="[(4, ref('base.user_root'))]"/>
         </record>
+
+        <record id="lunch_mind_your_own_food" model="ir.rule">
+            <field name="name">lunch.order: do not see and create other people's order</field>
+            <field name="model_id" ref="model_lunch_order"/>
+            <field name="groups" eval="[(4, ref('group_lunch_user'))]"/>
+            <field name="domain_force">[('user_id', '=', user.id)]</field>
+        </record>
+        <record id="lunch_mind_other_food" model="ir.rule">
+            <field name="name">lunch.order: do not see and create other people's order</field>
+            <field name="model_id" ref="model_lunch_order"/>
+            <field name="groups" eval="[(4, ref('group_lunch_manager'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+        </record>
+        <record id="lunch_mind_your_own_food_line" model="ir.rule">
+            <field name="name">lunch.order.line: do not see and create other people's order line</field>
+            <field name="model_id" ref="model_lunch_order_line"/>
+            <field name="groups" eval="[(4, ref('group_lunch_user'))]"/>
+            <field name="domain_force">[('user_id', '=', user.id)]</field>
+        </record>
+        <record id="lunch_mind_other_food_line" model="ir.rule">
+            <field name="name">lunch.order.line: do not see and create other people's order line</field>
+            <field name="model_id" ref="model_lunch_order_line"/>
+            <field name="groups" eval="[(4, ref('group_lunch_manager'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+        </record>
+        <record id="lunch_mind_your_own_food_money" model="ir.rule">
+            <field name="name">lunch.cashmove: do not see and create other people's cashmove</field>
+            <field name="model_id" ref="model_lunch_cashmove"/>
+            <field name="groups" eval="[(4, ref('group_lunch_user'))]"/>
+            <field name="domain_force">[('user_id', '=', user.id)]</field>
+        </record>
+        <record id="lunch_mind_other_food_money" model="ir.rule">
+            <field name="name">lunch.cashmove: do not see and create other people's cashmove</field>
+            <field name="model_id" ref="model_lunch_cashmove"/>
+            <field name="groups" eval="[(4, ref('group_lunch_manager'))]"/>
+            <field name="domain_force">[(1, '=', 1)]</field>
+        </record>
+
     </data>
 </openerp>