diff --git a/addons/account/security/ir.model.access.csv b/addons/account/security/ir.model.access.csv
index bc5f6536810..90962c9c44a 100644
--- a/addons/account/security/ir.model.access.csv
+++ b/addons/account/security/ir.model.access.csv
@@ -123,3 +123,19 @@ access_account_payment_method_readonly,account.payment.method,model_account_paym
 access_account_payment_method,account.payment.method,model_account_payment_method,account.group_account_invoice,1,1,1,1
 access_account_payment_readonly,account.payment,model_account_payment,account.group_account_readonly,1,0,0,0
 access_account_payment,account.payment,model_account_payment,account.group_account_invoice,1,1,1,1
+
+access_account_payment_register,access.account.payment.register,model_account_payment_register,account.group_account_invoice,1,1,1,0
+access_account_bank_statement_closebalance,access.account.bank.statement.closebalance,model_account_bank_statement_closebalance,account.group_account_user,1,1,1,0
+access_account_accrual_accounting_wizard,access.account.accrual.accounting.wizard,model_account_accrual_accounting_wizard,account.group_account_user,1,1,1,0
+access_account_unreconcile,access.account.unreconcile,model_account_unreconcile,account.group_account_user,1,1,1,0
+access_validate_account_move,access.validate.account.move,model_validate_account_move,account.group_account_invoice,1,1,1,0
+access_cash_box_out,access.cash.box.out,model_cash_box_out,account.group_account_user,1,1,1,0
+access_account_move_reversal,access.account.move.reversal,model_account_move_reversal,account.group_account_invoice,1,1,1,0
+access_account_common_report,access.account.common.report,model_account_common_report,account.group_account_user,1,1,1,0
+access_account_common_journal_report,access.account.common.journal.report,model_account_common_journal_report,account.group_account_user,1,1,1,0
+access_account_print_journal,access.account.print.journal,model_account_print_journal,account.group_account_user,1,1,1,0
+access_account_financial_year_op,access.account.financial.year.op,model_account_financial_year_op,account.group_account_manager,1,1,1,0
+access_account_setup_bank_manual_config,access.account.setup.bank.manual.config,model_account_setup_bank_manual_config,account.group_account_user,1,1,1,0
+access_tax_adjustments_wizard,access.tax.adjustments.wizard,model_tax_adjustments_wizard,account.group_account_user,1,1,1,0
+access_account_invoice_send,access.account.invoice.send,model_account_invoice_send,account.group_account_invoice,1,1,1,0
+access_account_transfer_wizard,access.account.transfer.wizard,model_account_transfer_wizard,account.group_account_user,1,1,1,0
diff --git a/addons/account/wizard/account_invoice_send_views.xml b/addons/account/wizard/account_invoice_send_views.xml
index 4db286a1ca8..3ec9db79a9b 100644
--- a/addons/account/wizard/account_invoice_send_views.xml
+++ b/addons/account/wizard/account_invoice_send_views.xml
@@ -86,8 +86,7 @@
             context="{
                 'default_template_id': ref('account.email_template_edi_invoice'),
                 'mark_invoice_as_sent': True,
-            }"
-            groups="account.group_account_invoice"/>
+            }"/>
 
     </data>
 
diff --git a/addons/account_check_printing/__manifest__.py b/addons/account_check_printing/__manifest__.py
index fbcd0bb7d39..4882c5ee815 100644
--- a/addons/account_check_printing/__manifest__.py
+++ b/addons/account_check_printing/__manifest__.py
@@ -13,6 +13,7 @@ The check settings are located in the accounting journals configuration page.
     """,
     'depends': ['account'],
     'data': [
+        'security/ir.model.access.csv',
         'data/account_check_printing_data.xml',
         'views/account_journal_views.xml',
         'views/account_payment_views.xml',
diff --git a/addons/account_check_printing/security/ir.model.access.csv b/addons/account_check_printing/security/ir.model.access.csv
new file mode 100644
index 00000000000..4009faf214b
--- /dev/null
+++ b/addons/account_check_printing/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_print_prenumbered_checks","access.print.prenumbered.checks","model_print_prenumbered_checks","account.group_account_user",1,1,1,0
diff --git a/addons/base_gengo/__manifest__.py b/addons/base_gengo/__manifest__.py
index 55e2355511f..b2bda792a01 100644
--- a/addons/base_gengo/__manifest__.py
+++ b/addons/base_gengo/__manifest__.py
@@ -16,6 +16,7 @@ This wizard will activate the CRON job and the Scheduler and will start the auto
     """,
     'depends': ['base_setup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/ir_cron_data.xml',
         'views/ir_translation_views.xml',
         'views/res_config_settings_views.xml',
diff --git a/addons/base_gengo/security/ir.model.access.csv b/addons/base_gengo/security/ir.model.access.csv
new file mode 100644
index 00000000000..b123cc2587f
--- /dev/null
+++ b/addons/base_gengo/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_gengo_translations","access.base.gengo.translations","model_base_gengo_translations","base.group_system",1,1,1,0
diff --git a/addons/base_import/security/ir.model.access.csv b/addons/base_import/security/ir.model.access.csv
index 06a166c91c9..f6105333408 100644
--- a/addons/base_import/security/ir.model.access.csv
+++ b/addons/base_import/security/ir.model.access.csv
@@ -15,3 +15,4 @@ access_base_import_tests_models_float,base.import.tests.models.float,model_base_
 access_base_import_tests_models_preview,base.import.tests.models.preview,model_base_import_tests_models_preview,base.group_user,1,1,1,1
 access_base_import_mapping,base.import.mapping,model_base_import_mapping,base.group_user,1,1,1,1
 access_base_import_tests_models_complex,access_base_import_tests_models_complex,model_base_import_tests_models_complex,base.group_user,1,0,0,0
+access_base_import_import,access.base_import.import,model_base_import_import,base.group_user,1,1,1,0
diff --git a/addons/base_import_module/__manifest__.py b/addons/base_import_module/__manifest__.py
index 0504bcfd6b3..e5b45d6337c 100644
--- a/addons/base_import_module/__manifest__.py
+++ b/addons/base_import_module/__manifest__.py
@@ -13,5 +13,8 @@ for customization purpose.
     'depends': ['web'],
     'installable': True,
     'auto_install': False,
-    'data': ['views/base_import_module_view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'views/base_import_module_view.xml'
+    ],
 }
diff --git a/addons/base_import_module/security/ir.model.access.csv b/addons/base_import_module/security/ir.model.access.csv
new file mode 100644
index 00000000000..35b8d2bc0d9
--- /dev/null
+++ b/addons/base_import_module/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_base_import_module","access.base.import.module","model_base_import_module","base.group_system",1,1,1,0
diff --git a/addons/base_sparse_field/__manifest__.py b/addons/base_sparse_field/__manifest__.py
index d98d9cb81a0..a13593b783f 100644
--- a/addons/base_sparse_field/__manifest__.py
+++ b/addons/base_sparse_field/__manifest__.py
@@ -12,6 +12,7 @@
     'version': '1.0',
     'depends': ['base'],
     'data': [
+        'security/ir.model.access.csv',
         'views/views.xml',
     ],
 }
diff --git a/addons/base_sparse_field/security/ir.model.access.csv b/addons/base_sparse_field/security/ir.model.access.csv
new file mode 100644
index 00000000000..c163e1f2c64
--- /dev/null
+++ b/addons/base_sparse_field/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sparse_fields_test","access.sparse_fields.test","model_sparse_fields_test","base.group_system",1,1,1,0
diff --git a/addons/crm/security/ir.model.access.csv b/addons/crm/security/ir.model.access.csv
index 7269054d25b..95308da62b1 100644
--- a/addons/crm/security/ir.model.access.csv
+++ b/addons/crm/security/ir.model.access.csv
@@ -23,3 +23,8 @@ access_calendar_event_type_sale_salesman,calendar.event.type.salesman,calendar.m
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_crm_lead_scoring_frequency,access_crm_lead_scoring_frequency,model_crm_lead_scoring_frequency,sales_team.group_sale_salesman,1,0,0,0
 access_crm_lead_scoring_frequency_field,access_crm_lead_scoring_frequency_field,model_crm_lead_scoring_frequency_field,sales_team.group_sale_salesman,1,0,0,0
+access_crm_lead_lost,access.crm.lead.lost,model_crm_lead_lost,sales_team.group_sale_salesman,1,1,1,0
+access_crm_partner_binding,access.crm.partner.binding,model_crm_partner_binding,base.group_partner_manager,1,1,1,0
+access_crm_lead2opportunity_partner,access.crm.lead2opportunity.partner,model_crm_lead2opportunity_partner,sales_team.group_sale_salesman,1,1,1,0
+access_crm_lead2opportunity_partner_mass,access.crm.lead2opportunity.partner.mass,model_crm_lead2opportunity_partner_mass,sales_team.group_sale_salesman,1,1,1,0
+access_crm_merge_opportunity,access.crm.merge.opportunity,model_crm_merge_opportunity,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/crm/tests/test_crm_lead_lost.py b/addons/crm/tests/test_crm_lead_lost.py
index 1cc0defab98..7f2819f7825 100644
--- a/addons/crm/tests/test_crm_lead_lost.py
+++ b/addons/crm/tests/test_crm_lead_lost.py
@@ -28,9 +28,10 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids,
-        }).create({})
+        }).create({
+            'lost_reason_id': self.lost_reason.id
+        })
 
-        lost_wizard.write({'lost_reason_id': self.lost_reason.id})
         lost_wizard.action_lost_reason_apply()
 
         self.assertEqual(lead.probability, 0)
@@ -55,8 +56,9 @@ class TestLeadConvert(crm_common.TestCrmCommon):
 
         lost_wizard = self.env['crm.lead.lost'].with_context({
             'active_ids': lead.ids
-        }).create({})
-        lost_wizard.write({'lost_reason_id': lost_reason.id})
+        }).create({
+            'lost_reason_id': lost_reason.id
+        })
 
         # nice try little salesman, you cannot invoke a wizard to update other people leads
         with self.assertRaises(AccessError):
diff --git a/addons/crm/views/crm_lead_views.xml b/addons/crm/views/crm_lead_views.xml
index bdb2cbaf82c..0f364c4df71 100644
--- a/addons/crm/views/crm_lead_views.xml
+++ b/addons/crm/views/crm_lead_views.xml
@@ -751,7 +751,6 @@
                             'default_use_template': True,
                             'default_template_id': ref('crm.email_template_opportunity_mail'),
                         }"
-                groups="sales_team.group_sale_salesman"
                 />
 
         <!--Update of email_template defined in crm_lead_data, to add ref_ir_act_window
diff --git a/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml b/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
index 539a270556e..428812fddd4 100644
--- a/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
+++ b/addons/crm/wizard/crm_lead_to_opportunity_mass_views.xml
@@ -58,6 +58,5 @@
         view_mode="form" target="new"
         context="{'mass_convert' : True}"
         view_id="view_crm_lead2opportunity_partner_mass"
-        groups="sales_team.group_sale_salesman"
     />
 </odoo>
diff --git a/addons/crm/wizard/crm_merge_opportunities_views.xml b/addons/crm/wizard/crm_merge_opportunities_views.xml
index 8b253dccec0..2eabe079cb9 100644
--- a/addons/crm/wizard/crm_merge_opportunities_views.xml
+++ b/addons/crm/wizard/crm_merge_opportunities_views.xml
@@ -40,7 +40,6 @@
             binding_model="crm.lead"
             binding_views="list"
             view_mode="form"
-            target="new"
-            groups="sales_team.group_sale_salesman" />
+            target="new" />
 
 </odoo>
diff --git a/addons/delivery/security/ir.model.access.csv b/addons/delivery/security/ir.model.access.csv
index 9c3f08c7a90..376581b094e 100644
--- a/addons/delivery/security/ir.model.access.csv
+++ b/addons/delivery/security/ir.model.access.csv
@@ -7,3 +7,5 @@ access_delivery_carrier_partner_manager,delivery.carrier partner_manager,model_d
 access_delivery_carrier_stock_user,delivery.carrier stock_user,model_delivery_carrier,stock.group_stock_user,1,0,0,0
 access_delivery_carrier_stock_manager,delivery.carrier,model_delivery_carrier,stock.group_stock_manager,1,1,1,1
 access_delivery_price_rule_stock_manager,delivery.price.rule,model_delivery_price_rule,stock.group_stock_manager,1,1,1,1
+access_choose_delivery_package,access.choose.delivery.package,model_choose_delivery_package,stock.group_stock_user,1,1,1,0
+access_choose_delivery_carrier,access.choose.delivery.carrier,model_choose_delivery_carrier,stock.group_stock_user,1,1,1,0
diff --git a/addons/event_sale/security/ir.model.access.csv b/addons/event_sale/security/ir.model.access.csv
index fbbe3fbeb29..06b66e1cf00 100644
--- a/addons/event_sale/security/ir.model.access.csv
+++ b/addons/event_sale/security/ir.model.access.csv
@@ -1,3 +1,6 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_product_template_event_manager,product.template.event.manager,product.model_product_template,event.group_event_manager,1,1,1,1
 access_product_product_event_manager,product.product.event.manager,product.model_product_product,event.group_event_manager,1,1,1,1
+access_registration_editor,access.registration.editor,model_registration_editor,sales_team.group_sale_salesman,1,1,1,0
+access_registration_editor_line,access.registration.editor.line,model_registration_editor_line,sales_team.group_sale_salesman,1,1,1,1
+access_event_event_configurator,access.event.event.configurator,model_event_event_configurator,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/gamification/security/ir.model.access.csv b/addons/gamification/security/ir.model.access.csv
index 728360ab386..ed8f9ffc8bb 100644
--- a/addons/gamification/security/ir.model.access.csv
+++ b/addons/gamification/security/ir.model.access.csv
@@ -30,3 +30,6 @@ gamification_karma_rank_access_all,gamification.karma.rank.access.all,gamificati
 gamification_karma_rank_access_user_manager,gamification.karma.rank.access.user.manager,gamification.model_gamification_karma_rank,base.group_system,1,1,1,1
 gamification_karma_tracking_access_all,gamification.karma.tracking.access.all,gamification.model_gamification_karma_tracking,,0,0,0,0
 gamification_karma_tracking_access_user_manager,gamification.karma.tracking.access.user.manager,gamification.model_gamification_karma_tracking,base.group_system,1,1,1,1
+
+access_gamification_goal_wizard,access.gamification.goal.wizard,model_gamification_goal_wizard,base.group_user,1,1,1,0
+access_gamification_badge_user_wizard,access.gamification.badge.user.wizard,model_gamification_badge_user_wizard,base.group_user,1,1,1,0
diff --git a/addons/google_account/models/google_service.py b/addons/google_account/models/google_service.py
index 384a565ced5..c424dd687af 100644
--- a/addons/google_account/models/google_service.py
+++ b/addons/google_account/models/google_service.py
@@ -22,8 +22,7 @@ GOOGLE_TOKEN_ENDPOINT = 'https://accounts.google.com/o/oauth2/token'
 GOOGLE_API_BASE_URL = 'https://www.googleapis.com'
 
 
-# FIXME : this needs to become an AbstractModel, to be inhereted by google_calendar_service and google_drive_service
-class GoogleService(models.TransientModel):
+class GoogleService(models.AbstractModel):
     _name = 'google.service'
     _description = 'Google Service'
 
diff --git a/addons/hr/security/ir.model.access.csv b/addons/hr/security/ir.model.access.csv
index e28b4065ee3..906cef3ee87 100644
--- a/addons/hr/security/ir.model.access.csv
+++ b/addons/hr/security/ir.model.access.csv
@@ -13,3 +13,5 @@ access_hr_plan_activity_type_employee,access_hr_plan_activity_type,model_hr_plan
 access_hr_plan_employee,access_hr_plan_employee,model_hr_plan,base.group_user,1,0,0,0
 access_hr_plan_activity_type_hr_user,access_hr_plan_activity_type,model_hr_plan_activity_type,group_hr_user,1,1,1,1
 access_hr_plan_hr_user,access_hr_plan_hr_user,model_hr_plan,group_hr_user,1,1,1,1
+access_hr_plan_wizard,access.hr.plan.wizard,model_hr_plan_wizard,hr.group_hr_manager,1,1,1,0
+access_hr_departure_wizard,access.hr.departure.wizard,model_hr_departure_wizard,hr.group_hr_user,1,1,1,0
diff --git a/addons/hr_expense/security/ir.model.access.csv b/addons/hr_expense/security/ir.model.access.csv
index 3f44a089213..8db618224fd 100644
--- a/addons/hr_expense/security/ir.model.access.csv
+++ b/addons/hr_expense/security/ir.model.access.csv
@@ -16,3 +16,5 @@ access_account_move_user,account.move.user,account.model_account_move,hr_expense
 access_account_move_line_user,account.move.line.user,account.model_account_move_line,hr_expense.group_hr_expense_team_approver,1,0,0,0
 access_account_analytic_line_user,account.analytic.line.user,account.model_account_analytic_line,hr_expense.group_hr_expense_team_approver,1,1,1,1
 access_mail_activity_type_expense_user,mail.activity.type.expense.user,mail.model_mail_activity_type,hr_expense.group_hr_expense_manager,1,1,1,1
+access_hr_expense_refuse_wizard,access.hr.expense.refuse.wizard,model_hr_expense_refuse_wizard,hr_expense.group_hr_expense_team_approver,1,1,1,0
+access_hr_expense_sheet_register_payment_wizard,access.hr.expense.sheet.register.payment.wizard,model_hr_expense_sheet_register_payment_wizard,account.group_account_manager,1,1,1,0
diff --git a/addons/hr_holidays/security/ir.model.access.csv b/addons/hr_holidays/security/ir.model.access.csv
index ec266b6e4d0..5c966878c8a 100644
--- a/addons/hr_holidays/security/ir.model.access.csv
+++ b/addons/hr_holidays/security/ir.model.access.csv
@@ -14,3 +14,4 @@ access_calendar_event_hr_user,calendar.event.hr.user,calendar.model_calendar_eve
 access_calendar_event_type_manager,calendar.event.type.manager,calendar.model_calendar_event_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
 access_calendar_attendee_hr_user,calendar.attendee.hr.user,calendar.model_calendar_attendee,hr_holidays.group_hr_holidays_user,1,1,1,1
 access_mail_activity_type_holidays_manager,mail.activity.type.holidays.manager,mail.model_mail_activity_type,hr_holidays.group_hr_holidays_manager,1,1,1,1
+access_hr_holidays_summary_employee,access.hr.holidays.summary.employee,model_hr_holidays_summary_employee,hr_holidays.group_hr_holidays_user,1,1,1,0
diff --git a/addons/hr_recruitment/security/ir.model.access.csv b/addons/hr_recruitment/security/ir.model.access.csv
index c33c641e7b7..646f2a8857b 100644
--- a/addons/hr_recruitment/security/ir.model.access.csv
+++ b/addons/hr_recruitment/security/ir.model.access.csv
@@ -11,3 +11,4 @@ access_hr_recruitment_source_all,hr.recruitment.source,model_hr_recruitment_sour
 access_hr_applicant_category,hr.applicant_category,model_hr_applicant_category,,1,1,1,0
 access_hr_applicant_category_manager,hr.applicant_category,model_hr_applicant_category,group_hr_recruitment_user,1,1,1,1
 access_calendar_event_type_hr_officer,calendar.event.type.officer,calendar.model_calendar_event_type,group_hr_recruitment_user,1,1,1,0
+access_applicant_get_refuse_reason,access.applicant.get.refuse.reason,model_applicant_get_refuse_reason,hr_recruitment.group_hr_recruitment_user,1,1,1,0
diff --git a/addons/hr_timesheet/security/ir.model.access.csv b/addons/hr_timesheet/security/ir.model.access.csv
index cb11fb119f7..db5329a5262 100644
--- a/addons/hr_timesheet/security/ir.model.access.csv
+++ b/addons/hr_timesheet/security/ir.model.access.csv
@@ -4,3 +4,4 @@ access_account_analytic_user,analytic.account.analytic.timesheet.user,analytic.m
 access_uom_uom_hr_timesheet,uom.uom.timesheet.user,uom.model_uom_uom,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_project,project.project.timesheet.user,model_project_project,hr_timesheet.group_hr_timesheet_user,1,0,0,0
 access_project_task,project.task.timesheet.user,model_project_task,hr_timesheet.group_hr_timesheet_user,1,1,0,0
+access_project_task_create_timesheet,access.project.task.create.timesheet,model_project_task_create_timesheet,hr_timesheet.group_hr_timesheet_user,1,1,1,0
diff --git a/addons/l10n_eu_service/security/ir.model.access.csv b/addons/l10n_eu_service/security/ir.model.access.csv
index 7a41aa15907..65d7ff4f6db 100644
--- a/addons/l10n_eu_service/security/ir.model.access.csv
+++ b/addons/l10n_eu_service/security/ir.model.access.csv
@@ -1,3 +1,4 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_l10n_eu_service_service_tax_rate_user,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,,1,0,0,0
 access_l10n_eu_service_service_tax_rate_manager,access_l10n_eu_service_service_tax_rate,model_l10n_eu_service_service_tax_rate,account.group_account_manager,1,1,1,1
+access_l10n_eu_service_wizard,access.l10n_eu_service.wizard,model_l10n_eu_service_wizard,account.group_account_manager,1,1,1,0
diff --git a/addons/mail/security/ir.model.access.csv b/addons/mail/security/ir.model.access.csv
index 2f21338e9f4..6a5e71f7e1e 100644
--- a/addons/mail/security/ir.model.access.csv
+++ b/addons/mail/security/ir.model.access.csv
@@ -38,3 +38,10 @@ access_mail_activity_type_all,mail.activity.type.all,model_mail_activity_type,,0
 access_mail_activity_type_user,mail.activity.type.user,model_mail_activity_type,base.group_user,1,0,0,0
 access_mail_activity_type_system,mail.activity.type.system,model_mail_activity_type,base.group_system,1,1,1,1
 access_mail_blacklist_system,access_mail_blacklist_system,model_mail_blacklist,base.group_system,1,1,1,1
+access_mail_wizard_invite,access.mail.wizard.invite,model_mail_wizard_invite,base.group_user,1,1,1,0
+access_mail_compose_message,access.mail.compose.message,model_mail_compose_message,base.group_user,1,1,1,0
+access_mail_compose_message_portal,access.mail.compose.message.portal,model_mail_compose_message,base.group_portal,1,1,1,0
+access_mail_resend_cancel,access.mail.resend.cancel,model_mail_resend_cancel,base.group_user,1,1,1,0
+access_mail_resend_message,access.mail.resend.message,model_mail_resend_message,base.group_user,1,1,1,0
+access_mail_resend_partner,access.mail.resend.partner,model_mail_resend_partner,base.group_user,1,1,1,0
+access_mail_template_preview,access.mail.template.preview,model_mail_template_preview,base.group_user,1,1,1,0
diff --git a/addons/mail/security/mail_security.xml b/addons/mail/security/mail_security.xml
index 3a98e1bddb2..036f9a275c2 100644
--- a/addons/mail/security/mail_security.xml
+++ b/addons/mail/security/mail_security.xml
@@ -47,5 +47,16 @@
             <field name="model_id" ref="model_mail_moderation"/>
             <field name="domain_force">[('channel_id.moderator_ids', 'in', user.id)]</field>
         </record>
+
+        <record id="mail_compose_message_rule" model="ir.rule">
+            <field name="name">Mail Compose Message Rule</field>
+            <field name="model_id" ref="model_mail_compose_message"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+            <field name="global" eval="True"/>
+            <field name="perm_create" eval="False"/>
+            <field name="perm_read" eval="True"/>
+            <field name="perm_write" eval="True"/>
+            <field name="perm_unlink" eval="False"/>
+        </record>
     </data>
 </odoo>
diff --git a/addons/mass_mailing/security/ir.model.access.csv b/addons/mass_mailing/security/ir.model.access.csv
index 63d65ed09c7..063640e8906 100644
--- a/addons/mass_mailing/security/ir.model.access.csv
+++ b/addons/mass_mailing/security/ir.model.access.csv
@@ -14,3 +14,6 @@ access_utm_source,access_utm_source,utm.model_utm_source,mass_mailing.group_mass
 access_ir_mail_server,access_ir_mail_server,base.model_ir_mail_server,mass_mailing.group_mass_mailing_user,1,0,0,0
 access_mail_blacklist_mass_mailing_user,access.mail.blacklist.mass_mailing_user,mail.model_mail_blacklist,mass_mailing.group_mass_mailing_user,1,1,1,1
 access_link_tracker_mailing,access.link.tracker.mailing,link_tracker.model_link_tracker,mass_mailing.group_mass_mailing_user,1,1,1,1
+access_mailing_list_merge,access.mailing.list.merge,model_mailing_list_merge,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_schedule_date,access.mailing.mailing.schedule.date,model_mailing_mailing_schedule_date,mass_mailing.group_mass_mailing_user,1,1,1,0
+access_mailing_mailing_test,access.mailing.mailing.test,model_mailing_mailing_test,mass_mailing.group_mass_mailing_user,1,1,1,0
diff --git a/addons/mass_mailing_sms/security/ir.model.access.csv b/addons/mass_mailing_sms/security/ir.model.access.csv
index 4a08a4aa60d..d6614405020 100644
--- a/addons/mass_mailing_sms/security/ir.model.access.csv
+++ b/addons/mass_mailing_sms/security/ir.model.access.csv
@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_mailing_sms_test,access.mailing.sms.test,model_mailing_sms_test,mass_mailing.group_mass_mailing_user,1,1,1,0
diff --git a/addons/membership/security/ir.model.access.csv b/addons/membership/security/ir.model.access.csv
index d53e57a5151..b0165407cdd 100644
--- a/addons/membership/security/ir.model.access.csv
+++ b/addons/membership/security/ir.model.access.csv
@@ -2,3 +2,4 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_membership_membership_line_partner_manager,membership.membership_line partner_manager,model_membership_membership_line,base.group_partner_manager,1,1,1,1
 access_membership_membership_line,membership.membership_line,model_membership_membership_line,,1,0,0,0
 access_report_membership,report.membership,model_report_membership,base.group_partner_manager,1,0,0,0
+access_membership_invoice,access.membership.invoice,model_membership_invoice,account.group_account_user,1,1,1,0
diff --git a/addons/mrp/security/ir.model.access.csv b/addons/mrp/security/ir.model.access.csv
index f658a124936..f3da2c3d932 100644
--- a/addons/mrp/security/ir.model.access.csv
+++ b/addons/mrp/security/ir.model.access.csv
@@ -60,3 +60,7 @@ access_mrp_unbuild,mrp.unbuild,model_mrp_unbuild,group_mrp_user,1,1,1,1
 access_mrp_unbuild_manager,mrp.unbuild manager,model_mrp_unbuild,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_manager,mrp.document group_user,model_mrp_document,group_mrp_manager,1,1,1,1
 access_mrp_document_mrp_user,mrp.document group_user,model_mrp_document,group_mrp_user,1,1,1,1
+access_mrp_product_produce,access.mrp.product.produce,model_mrp_product_produce,mrp.group_mrp_user,1,1,1,0
+access_mrp_product_produce_line,access.mrp.product.produce.line,model_mrp_product_produce_line,mrp.group_mrp_user,1,1,1,1
+access_change_production_qty,access.change.production.qty,model_change_production_qty,mrp.group_mrp_user,1,1,1,0
+access_stock_warn_insufficient_qty_unbuild,access.stock.warn.insufficient.qty.unbuild,model_stock_warn_insufficient_qty_unbuild,mrp.group_mrp_user,1,1,1,0
diff --git a/addons/payment/security/ir.model.access.csv b/addons/payment/security/ir.model.access.csv
index 76d11991b88..4737473135b 100644
--- a/addons/payment/security/ir.model.access.csv
+++ b/addons/payment/security/ir.model.access.csv
@@ -10,4 +10,6 @@ payment_method_portal,payment.token.portal,model_payment_token,base.group_portal
 payment_method_system,payment.token.system,model_payment_token,base.group_system,1,1,1,1
 payment_icon_all,payment.icon.all,model_payment_icon,,1,0,0,0
 payment_icon_user,payment.icon.user,model_payment_icon,base.group_user,1,1,1,0
-payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
\ No newline at end of file
+payment_icon_system,payment.icon.system,model_payment_icon,base.group_system,1,1,1,1
+access_payment_acquirer_onboarding_wizard,access.payment.acquirer.onboarding.wizard,model_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_payment_link_wizard,access.payment.link.wizard,model_payment_link_wizard,account.group_account_user,1,1,1,0
diff --git a/addons/point_of_sale/security/ir.model.access.csv b/addons/point_of_sale/security/ir.model.access.csv
index 76fe06de68d..1776a2e2ce2 100644
--- a/addons/point_of_sale/security/ir.model.access.csv
+++ b/addons/point_of_sale/security/ir.model.access.csv
@@ -40,3 +40,6 @@ access_decimal_precision_user,decimal.precision,base.model_decimal_precision,gro
 access_pos_payment_user,pos.payment user,model_pos_payment,group_pos_user,1,1,1,1
 access_pos_payment_method_user,pos.payment.method user,model_pos_payment_method,group_pos_user,1,0,0,0
 access_pos_payment_method_manager,pos.payment.method manager,model_pos_payment_method,group_pos_manager,1,1,1,1
+access_closing_balance_confirm_wizard,access.closing.balance.confirm.wizard,model_closing_balance_confirm_wizard,point_of_sale.group_pos_manager,0,0,0,0
+access_pos_details_wizard,access.pos.details.wizard,model_pos_details_wizard,point_of_sale.group_pos_manager,1,1,1,0
+access_pos_make_payment,access.pos.make.payment,model_pos_make_payment,point_of_sale.group_pos_manager,1,1,1,0
diff --git a/addons/portal/__manifest__.py b/addons/portal/__manifest__.py
index b2e9843f8ca..d396abdc6cd 100644
--- a/addons/portal/__manifest__.py
+++ b/addons/portal/__manifest__.py
@@ -17,6 +17,7 @@ of this module is to allow the display of a customer portal without having
 a dependency towards website edition and customization capabilities.""",
     'depends': ['web', 'web_editor', 'http_routing', 'mail', 'auth_signup'],
     'data': [
+        'security/ir.model.access.csv',
         'data/portal_data.xml',
         'views/assets.xml',
         'views/portal_templates.xml',
diff --git a/addons/portal/security/ir.model.access.csv b/addons/portal/security/ir.model.access.csv
new file mode 100644
index 00000000000..6506676a9e5
--- /dev/null
+++ b/addons/portal/security/ir.model.access.csv
@@ -0,0 +1,4 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_portal_share","access.portal.share","model_portal_share","base.group_partner_manager",1,1,1,0
+"access_portal_wizard","access.portal.wizard","model_portal_wizard","base.group_partner_manager",1,1,1,0
+"access_portal_wizard_user","access.portal.wizard.user","model_portal_wizard_user","base.group_partner_manager",1,1,1,0
diff --git a/addons/portal/wizard/portal_wizard_views.xml b/addons/portal/wizard/portal_wizard_views.xml
index 05cf6714d3b..92f25c87811 100644
--- a/addons/portal/wizard/portal_wizard_views.xml
+++ b/addons/portal/wizard/portal_wizard_views.xml
@@ -5,8 +5,7 @@
             name="Grant portal access"
             binding_model="res.partner"
             res_model="portal.wizard"
-            view_mode="form" target="new"
-            groups="base.group_partner_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- wizard view -->
         <record id="wizard_view" model="ir.ui.view">
diff --git a/addons/product_expiry/__manifest__.py b/addons/product_expiry/__manifest__.py
index 4cb792f72f1..88356340cac 100644
--- a/addons/product_expiry/__manifest__.py
+++ b/addons/product_expiry/__manifest__.py
@@ -17,7 +17,8 @@ Following dates can be tracked:
 
 Also implements the removal strategy First Expiry First Out (FEFO) widely used, for example, in food industries.
 """,
-    'data': ['views/production_lot_views.xml',
+    'data': ['security/ir.model.access.csv',
+             'views/production_lot_views.xml',
              'views/product_template_views.xml',
              'views/stock_move_views.xml',
              'views/stock_quant_views.xml',
diff --git a/addons/product_expiry/security/ir.model.access.csv b/addons/product_expiry/security/ir.model.access.csv
new file mode 100644
index 00000000000..3996979a446
--- /dev/null
+++ b/addons/product_expiry/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_expiry_picking_confirmation","access.expiry.picking.confirmation","model_expiry_picking_confirmation","stock.group_stock_user",1,1,1,0
diff --git a/addons/product_margin/security/ir.model.access.csv b/addons/product_margin/security/ir.model.access.csv
index 4a08a4aa60d..81faf868345 100644
--- a/addons/product_margin/security/ir.model.access.csv
+++ b/addons/product_margin/security/ir.model.access.csv
@@ -1 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_product_margin,access.product.margin,model_product_margin,account.group_account_user,1,1,1,0
diff --git a/addons/repair/security/ir.model.access.csv b/addons/repair/security/ir.model.access.csv
index eca832db8d3..71d03880f13 100644
--- a/addons/repair/security/ir.model.access.csv
+++ b/addons/repair/security/ir.model.access.csv
@@ -5,3 +5,6 @@ access_repair_tag_user,Repair Tags user,model_repair_tags,stock.group_stock_user
 access_stock_production_lot_user,stock.production.lot user,stock.model_stock_production_lot,stock.group_stock_user,1,1,1,1
 access_repair_line_user,repair.line user,model_repair_line,stock.group_stock_user,1,1,1,1
 access_account_tax_user,account.tax,account.model_account_tax,stock.group_stock_user,1,1,1,1
+access_repair_cancel,access.repair.cancel,model_repair_cancel,stock.group_stock_user,1,1,1,0
+access_repair_order_make_invoice,access.repair.order.make_invoice,model_repair_order_make_invoice,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_repair,access.stock.warn.insufficient.qty.repair,model_stock_warn_insufficient_qty_repair,stock.group_stock_user,1,1,1,0
diff --git a/addons/sale/security/ir.model.access.csv b/addons/sale/security/ir.model.access.csv
index 3dec3d9c007..d3bc9376ed8 100644
--- a/addons/sale/security/ir.model.access.csv
+++ b/addons/sale/security/ir.model.access.csv
@@ -55,3 +55,7 @@ access_account_tax_group_sale_manager,account.tax.group sale manager,account.mod
 access_account_account_sale_manager,account.account sale manager,account.model_account_account,sales_team.group_sale_manager,1,0,0,0
 access_mail_activity_type_sale_manager,mail.activity.type.sale.manager,mail.model_mail_activity_type,sales_team.group_sale_manager,1,1,1,1
 access_report_all_channels_sales,access_report_all_channels_sales,model_report_all_channels_sales,sales_team.group_sale_manager,1,0,0,0
+access_sale_payment_acquirer_onboarding_wizard,access.sale.payment.acquirer.onboarding.wizard,model_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
+access_sale_advance_payment_inv,access.sale.advance.payment.inv,model_sale_advance_payment_inv,sales_team.group_sale_salesman,1,1,1,0
+access_sale_order_cancel,access.sale.order.cancel,model_sale_order_cancel,sales_team.group_sale_salesman,1,1,1,0
+access_payment_link_wizard_sale,access.payment.link.wizard.sale,model_payment_link_wizard,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml
index bd0508e1ef7..942844709e1 100644
--- a/addons/sale/security/sale_security.xml
+++ b/addons/sale/security/sale_security.xml
@@ -187,5 +187,27 @@
         <field name="domain_force">[('move_id.type', 'in', ('out_invoice', 'out_refund', 'in_invoice', 'in_refund'))]</field>
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
+    
+    <!-- Wizard access rules -->
+    <record id="sale_payment_acquirer_onboarding_wizard_rule" model="ir.rule">
+        <field name="name">Payment Acquier Onboarding Wizard Rule</field>
+        <field name="model_id" ref="model_sale_payment_acquirer_onboarding_wizard"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_advance_payment_inv_rule" model="ir.rule">
+        <field name="name">Sales Advance Payment Invoice Rule</field>
+        <field name="model_id" ref="model_sale_advance_payment_inv"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+    <record id="sale_order_cancel_rule" model="ir.rule">
+        <field name="name">Sales Order Cancel Rule</field>
+        <field name="model_id" ref="model_sale_order_cancel"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
 </data>
 </odoo>
diff --git a/addons/sale/wizard/sale_make_invoice_advance_views.xml b/addons/sale/wizard/sale_make_invoice_advance_views.xml
index 5af37ef6a24..3dd0a99cec0 100644
--- a/addons/sale/wizard/sale_make_invoice_advance_views.xml
+++ b/addons/sale/wizard/sale_make_invoice_advance_views.xml
@@ -56,7 +56,6 @@
             <field name="res_model">sale.advance.payment.inv</field>
             <field name="view_mode">form</field>
             <field name="target">new</field>
-            <field name="groups_id" eval="[(4,ref('sales_team.group_sale_salesman'))]"/>
             <!-- TODO: check if we need this -->
             <field name="binding_model_id" ref="sale.model_sale_order" />
             <field name="binding_view_types">list</field>
diff --git a/addons/sale_coupon/__manifest__.py b/addons/sale_coupon/__manifest__.py
index 59e0d22d6f5..c731a4d1b0b 100644
--- a/addons/sale_coupon/__manifest__.py
+++ b/addons/sale_coupon/__manifest__.py
@@ -8,6 +8,7 @@
     'version': '1.0',
     'depends': ['sale_management'],
     'data': [
+        'security/sale_coupon_security.xml',
         'security/ir.model.access.csv',
         'wizard/sale_coupon_apply_code_views.xml',
         'wizard/sale_coupon_generate_views.xml',
diff --git a/addons/sale_coupon/security/ir.model.access.csv b/addons/sale_coupon/security/ir.model.access.csv
index 18ec5bda7ae..265de7613e9 100644
--- a/addons/sale_coupon/security/ir.model.access.csv
+++ b/addons/sale_coupon/security/ir.model.access.csv
@@ -7,3 +7,5 @@ access_coupon_salesman,salesman,model_sale_coupon,sales_team.group_sale_salesman
 access_coupon_manager,program manager,model_sale_coupon,sales_team.group_sale_manager,1,1,1,0
 access_reward_salesman,salesman,model_sale_coupon_reward,sales_team.group_sale_salesman,1,0,0,0
 access_reward_manager,program manager,model_sale_coupon_reward,sales_team.group_sale_manager,1,1,1,0
+access_sale_coupon_apply_code,access.sale.coupon.apply.code,model_sale_coupon_apply_code,sales_team.group_sale_salesman,1,1,1,0
+access_sale_coupon_generate,access.sale.coupon.generate,model_sale_coupon_generate,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_coupon/security/sale_coupon_security.xml b/addons/sale_coupon/security/sale_coupon_security.xml
new file mode 100644
index 00000000000..fa5b89ef5ef
--- /dev/null
+++ b/addons/sale_coupon/security/sale_coupon_security.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+<data noupdate="1">
+
+    <record id="sale_coupon_apply_code_rule" model="ir.rule">
+        <field name="name">Sale Coupon Apply Code Rule</field>
+        <field name="model_id" ref="model_sale_coupon_apply_code"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+    <record id="sale_coupon_generate_rule" model="ir.rule">
+        <field name="name">Generate Sales Coupon Rule</field>
+        <field name="model_id" ref="model_sale_coupon_generate"/>
+        <field name="global" eval="True"/>
+        <field name="domain_force">[('create_uid', '=', user.id)]</field>
+    </record>
+
+</data>
+</odoo>
diff --git a/addons/sale_crm/security/ir.model.access.csv b/addons/sale_crm/security/ir.model.access.csv
index 75317a244ad..7751d54565c 100644
--- a/addons/sale_crm/security/ir.model.access.csv
+++ b/addons/sale_crm/security/ir.model.access.csv
@@ -1,2 +1,2 @@
-id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_crm_quotation_partner,access.crm.quotation.partner,model_crm_quotation_partner,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_product_configurator/__manifest__.py b/addons/sale_product_configurator/__manifest__.py
index 5211fcaf4e7..c24fa65c12a 100644
--- a/addons/sale_product_configurator/__manifest__.py
+++ b/addons/sale_product_configurator/__manifest__.py
@@ -15,6 +15,7 @@ It also enables the "optional products" feature.
 
     'depends': ['sale'],
     'data': [
+        'security/ir.model.access.csv',
         'views/assets.xml',
         'views/templates.xml',
         'views/sale_views.xml',
diff --git a/addons/sale_product_configurator/security/ir.model.access.csv b/addons/sale_product_configurator/security/ir.model.access.csv
new file mode 100644
index 00000000000..1c8e002cafd
--- /dev/null
+++ b/addons/sale_product_configurator/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_sale_product_configurator","access.sale.product.configurator","model_sale_product_configurator","sales_team.group_sale_salesman",1,1,1,0
diff --git a/addons/sale_timesheet/security/ir.model.access.csv b/addons/sale_timesheet/security/ir.model.access.csv
index 371bd9a61e3..74e49f82654 100644
--- a/addons/sale_timesheet/security/ir.model.access.csv
+++ b/addons/sale_timesheet/security/ir.model.access.csv
@@ -2,3 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_project_profitability_report_analysis_manager,project.profitability.report.analysis,model_project_profitability_report,project.group_project_manager,1,1,1,1
 access_project_sale_line_employee_map,access_project_sale_line_employee_map,model_project_sale_line_employee_map,base.group_user,1,0,0,0
 access_project_sale_line_employee_map_manager,access_project_sale_line_employee_map_project_manager,model_project_sale_line_employee_map,project.group_project_manager,1,1,1,1
+access_project_create_sale_order,access.project.create.sale.order,model_project_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_sale_order_line,access.project.create.sale.order.line,model_project_create_sale_order_line,sales_team.group_sale_salesman,1,1,1,0
+access_project_create_invoice,access.project.create.invoice,model_project_create_invoice,sales_team.group_sale_salesman_all_leads,1,1,1,0
+access_project_task_create_sale_order,access.project.task.create.sale.order,model_project_task_create_sale_order,sales_team.group_sale_salesman,1,1,1,0
diff --git a/addons/sale_timesheet/wizard/project_create_invoice_views.xml b/addons/sale_timesheet/wizard/project_create_invoice_views.xml
index 191cab2c0c4..55e2bdff034 100644
--- a/addons/sale_timesheet/wizard/project_create_invoice_views.xml
+++ b/addons/sale_timesheet/wizard/project_create_invoice_views.xml
@@ -26,7 +26,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_invoice_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman_all_leads'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
index db90b4b5402..a4a01bf2efa 100644
--- a/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
+++ b/addons/sale_timesheet/wizard/project_create_sale_order_views.xml
@@ -49,7 +49,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
index ec580dda564..7723545d87f 100644
--- a/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
+++ b/addons/sale_timesheet/wizard/project_task_create_sale_order_views.xml
@@ -31,7 +31,6 @@
         <field name="view_mode">form</field>
         <field name="view_id" ref="project_task_create_sale_order_view_form"/>
         <field name="target">new</field>
-        <field name="groups_id" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
 </odoo>
diff --git a/addons/sms/security/ir.model.access.csv b/addons/sms/security/ir.model.access.csv
index b5c75f2433f..bf54348054c 100644
--- a/addons/sms/security/ir.model.access.csv
+++ b/addons/sms/security/ir.model.access.csv
@@ -4,3 +4,8 @@ access_sms_sms_system,access.sms.sms.system,model_sms_sms,base.group_system,1,1,
 access_sms_template_all,access.sms.template.all,model_sms_template,,0,0,0,0
 access_sms_template_user,access.sms.template.user,model_sms_template,base.group_user,1,0,0,0
 access_sms_template_system,access.sms.template.system,model_sms_template,base.group_system,1,1,1,1
+access_sms_cancel,access.sms.cancel,model_sms_cancel,base.group_user,1,1,1,0
+access_sms_composer,access.sms.composer,model_sms_composer,base.group_user,1,1,1,0
+access_sms_resend_recipient,access.sms.resend.recipient,model_sms_resend_recipient,base.group_user,1,1,1,0
+access_sms_resend,access.sms.resend,model_sms_resend,base.group_user,1,1,1,0
+access_sms_template_preview,access.sms.template.preview,model_sms_template_preview,base.group_user,1,1,1,0
diff --git a/addons/snailmail/security/ir.model.access.csv b/addons/snailmail/security/ir.model.access.csv
index 3c111854063..c0bf2882c6d 100644
--- a/addons/snailmail/security/ir.model.access.csv
+++ b/addons/snailmail/security/ir.model.access.csv
@@ -2,4 +2,7 @@ id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_snailmail_letter_all,snailmail.letter.all,model_snailmail_letter,,1,0,0,0
 access_snailmail_letter_portal,snailmail.letter.portal,model_snailmail_letter,base.group_portal,1,0,1,0
 access_snailmail_letter_user,snailmail.letter.user,model_snailmail_letter,base.group_user,1,1,1,0
-access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
\ No newline at end of file
+access_snailmail_letter_system,snailmail.letter.system,model_snailmail_letter,base.group_system,1,1,1,1
+access_snailmail_letter_cancel,access.snailmail.letter.cancel,model_snailmail_letter_cancel,base.group_user,1,1,1,0
+access_snailmail_letter_format_error,access.snailmail.letter.format.error,model_snailmail_letter_format_error,base.group_user,1,1,1,0
+access_snailmail_letter_missing_required_fields,access.snailmail.letter.missing.required.fields,model_snailmail_letter_missing_required_fields,base.group_user,1,1,1,0
diff --git a/addons/stock/security/ir.model.access.csv b/addons/stock/security/ir.model.access.csv
index 596ac22548c..3b177eb51a0 100644
--- a/addons/stock/security/ir.model.access.csv
+++ b/addons/stock/security/ir.model.access.csv
@@ -72,3 +72,20 @@ access_product_product_attribute_manager,product.product.attribute manager value
 access_product_template_attribute_exclusion_manager,product.attribute manager filter line,product.model_product_template_attribute_exclusion,stock.group_stock_manager,1,1,1,1
 access_product_template_attribute_line_manager,product.attribute manager line,product.model_product_template_attribute_line,stock.group_stock_manager,1,1,1,1
 access_report_stock_quantity,access_report_stock_quantity,model_report_stock_quantity,base.group_user,1,0,0,0
+access_stock_traceability_report,access.stock.traceability.report,model_stock_traceability_report,stock.group_stock_user,1,1,1,0
+access_stock_assign_serial,access.stock.assign.serial,model_stock_assign_serial,stock.group_stock_user,1,1,1,0
+access_stock_return_picking_line,access.stock.return.picking.line,model_stock_return_picking_line,stock.group_stock_user,1,1,1,0
+access_stock_return_picking,access.stock.return.picking,model_stock_return_picking,stock.group_stock_user,1,1,1,0
+access_stock_change_product_qty,access.stock.change.product.qty,model_stock_change_product_qty,stock.group_stock_user,1,1,1,0
+access_stock_scheduler_compute,access.stock.scheduler.compute,model_stock_scheduler_compute,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer_line,access.stock.immediate.transfer.line,model_stock_immediate_transfer_line,stock.group_stock_user,1,1,1,0
+access_stock_immediate_transfer,access.stock.immediate.transfer,model_stock_immediate_transfer,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation_line,access.stock.backorder.confirmation.line,model_stock_backorder_confirmation_line,stock.group_stock_user,1,1,1,0
+access_stock_backorder_confirmation,access.stock.backorder.confirmation,model_stock_backorder_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_quantity_history,access.stock.quantity.history,model_stock_quantity_history,stock.group_stock_user,1,1,1,0
+access_stock_rules_report,access.stock.rules.report,model_stock_rules_report,stock.group_stock_user,1,1,1,0
+access_stock_warn_insufficient_qty_scrap,access.stock.warn.insufficient.qty.scrap,model_stock_warn_insufficient_qty_scrap,stock.group_stock_user,1,1,1,0
+access_product_replenish,access.product.replenish,model_product_replenish,stock.group_stock_user,1,1,1,0
+access_stock_track_confirmation,access.stock.track.confirmation,model_stock_track_confirmation,stock.group_stock_user,1,1,1,0
+access_stock_track_line,access.stock.track.line,model_stock_track_line,stock.group_stock_user,1,1,1,0
+access_stock_package_destination,access.stock.package.destination,model_stock_package_destination,stock.group_stock_user,1,1,1,0
diff --git a/addons/stock_picking_batch/security/ir.model.access.csv b/addons/stock_picking_batch/security/ir.model.access.csv
index 615ed649f59..31a6de03836 100644
--- a/addons/stock_picking_batch/security/ir.model.access.csv
+++ b/addons/stock_picking_batch/security/ir.model.access.csv
@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_stock_picking_batch,stock.picking.batch stock users,model_stock_picking_batch,stock.group_stock_user,1,1,1,1
+access_stock_picking_to_batch,access.stock.picking.to.batch,model_stock_picking_to_batch,stock.group_stock_user,1,1,1,0
diff --git a/addons/stock_sms/security/ir.model.access.csv b/addons/stock_sms/security/ir.model.access.csv
index 70870ff6dbf..822806bbe5c 100644
--- a/addons/stock_sms/security/ir.model.access.csv
+++ b/addons/stock_sms/security/ir.model.access.csv
@@ -1,2 +1,3 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
 access_sms_template_stock_manager,access.sms.template.stock.manager,sms.model_sms_template,stock.group_stock_manager,1,1,1,1
+access_confirm_stock_sms,access.confirm.stock.sms,model_confirm_stock_sms,stock.group_stock_user,1,1,1,0
diff --git a/addons/survey/security/ir.model.access.csv b/addons/survey/security/ir.model.access.csv
index 89cce9edfc5..39fec6457fd 100644
--- a/addons/survey/security/ir.model.access.csv
+++ b/addons/survey/security/ir.model.access.csv
@@ -20,3 +20,4 @@ access_survey_user_input_line_user,survey.user_input.line.user,model_survey_user
 access_survey_user_input_line_survey_user,survey.user_input.line.survey.user,model_survey_user_input_line,group_survey_user,1,1,1,1
 access_survey_user_input_line_survey_manager,survey.user_input.line.survey.manager,model_survey_user_input_line,group_survey_manager,1,1,1,1
 access_gamification_badge_survey_user,gamification.badge.survey.user,model_gamification_badge,group_survey_user,1,1,1,1
+access_survey_invite,access.survey.invite,model_survey_invite,survey.group_survey_user,1,1,1,0
diff --git a/addons/test_mail/tests/test_performance.py b/addons/test_mail/tests/test_performance.py
index 6cdc637ccf3..31c93f4a0fa 100644
--- a/addons/test_mail/tests/test_performance.py
+++ b/addons/test_mail/tests/test_performance.py
@@ -277,8 +277,8 @@ class TestMailAPIPerformance(BaseMailPerformance):
     def test_mail_composer_w_template(self):
         test_record = self.env['mail.test.full'].browse(self.test_record_full.id)
         test_template = self.env['mail.template'].browse(self.test_template_full.id)
-        # TODO XDO/TDE FIXME non deterministic between 25 and 28 queries
-        with self.assertQueryCount(__system__=28, emp=28):
+        # TODO XDO/TDE/MAT FIXME non deterministic between 25 and 29 queries
+        with self.assertQueryCount(__system__=28, emp=29):
             composer = self.env['mail.compose.message'].with_context({
                 'default_composition_mode': 'comment',
                 'default_model': test_record._name,
@@ -489,7 +489,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         record = self.umbrella.with_user(self.env.user)
         template_id = self.env.ref('test_mail.mail_test_tpl').id
 
-        with self.assertQueryCount(__system__=84, emp=85):
+        with self.assertQueryCount(__system__=84, emp=86):
             record.message_post_with_template(template_id, message_type='comment', composition_mode='comment')
 
         self.assertEqual(record.message_ids[0].body, '<p>Adding stuff on %s</p>' % record.name)
@@ -680,7 +680,7 @@ class TestMailComplexPerformance(BaseMailPerformance):
         rec1 = rec.with_context(active_test=False)      # to see inactive records
         self.assertEqual(rec1.message_partner_ids, self.partners | self.env.user.partner_id | self.user_portal.partner_id)
 
-        with self.assertQueryCount(__system__=34, emp=35):
+        with self.assertQueryCount(__system__=34, emp=36):
             rec.write({
                 'name': 'Test2',
                 'customer_id': customer_id,
diff --git a/addons/website/security/ir.model.access.csv b/addons/website/security/ir.model.access.csv
index 1053d765d0f..daa7630f376 100644
--- a/addons/website/security/ir.model.access.csv
+++ b/addons/website/security/ir.model.access.csv
@@ -21,3 +21,4 @@ access_theme_ir_ui_view,access_theme_ir_ui_view,model_theme_ir_ui_view,base.grou
 access_theme_ir_attachment,access_theme_ir_attachment,model_theme_ir_attachment,base.group_system,1,1,1,1
 access_theme_website_menu,access_theme_website_menu,model_theme_website_menu,base.group_system,1,1,1,1
 access_theme_website_page,access_theme_website_page,model_theme_website_page,base.group_system,1,1,1,1
+access_website_robots,access.website.robots,model_website_robots,website.group_website_designer,1,1,1,0
diff --git a/addons/website_crm_partner_assign/security/ir.model.access.csv b/addons/website_crm_partner_assign/security/ir.model.access.csv
index c400f632eee..3e07ee84ae2 100644
--- a/addons/website_crm_partner_assign/security/ir.model.access.csv
+++ b/addons/website_crm_partner_assign/security/ir.model.access.csv
@@ -10,3 +10,5 @@ access_partner_activation_manager,res.partner.activation.manager,model_res_partn
 partner_access_crm_lead,crm.lead,crm.model_crm_lead,base.group_portal,1,1,0,0
 access_res_partner_grade_invoicing_payment_readonly,res.partner.grade,model_res_partner_grade,account.group_account_readonly,1,0,0,0
 access_res_partner_grade_invoicing_payment,res.partner.grade,model_res_partner_grade,account.group_account_invoice,1,0,0,0
+access_crm_lead_forward_to_partner,access.crm.lead.forward.to.partner,model_crm_lead_forward_to_partner,sales_team.group_sale_manager,1,1,1,0
+access_crm_lead_assignation,access.crm.lead.assignation,model_crm_lead_assignation,sales_team.group_sale_manager,1,1,1,0
diff --git a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
index 20efa652097..a86faea87c7 100644
--- a/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
+++ b/addons/website_crm_partner_assign/wizard/crm_forward_to_partner_view.xml
@@ -48,7 +48,6 @@
             name="Forward to partner" res_model="crm.lead.forward.to.partner"
             binding_model="crm.lead"
             view_mode="form" target="new"
-            groups="sales_team.group_sale_manager"
             context="{'default_composition_mode' : 'mass_mail'}" view_id="crm_lead_forward_to_partner_form" />
 
 </odoo>
diff --git a/addons/website_sale/security/ir.model.access.csv b/addons/website_sale/security/ir.model.access.csv
index 6da9fe3be19..625480f9611 100644
--- a/addons/website_sale/security/ir.model.access.csv
+++ b/addons/website_sale/security/ir.model.access.csv
@@ -21,3 +21,4 @@ access_account_tax_user,account.tax,account.model_account_tax,base.group_public,
 access_product_image_public,product.image public,model_product_image,,1,0,0,0
 access_product_image_publisher,product.image wbesite publisher,model_product_image,website.group_website_publisher,1,1,1,1
 access_product_image_sale,product.image sale,model_product_image,sales_team.group_sale_manager,1,1,1,1
+access_website_sale_payment_acquirer_onboarding_wizard,access.website.sale.payment.acquirer.onboarding.wizard,model_website_sale_payment_acquirer_onboarding_wizard,base.group_system,1,1,1,0
diff --git a/addons/website_slides/security/ir.model.access.csv b/addons/website_slides/security/ir.model.access.csv
index 43f14a23bbf..355ebc5ade4 100644
--- a/addons/website_slides/security/ir.model.access.csv
+++ b/addons/website_slides/security/ir.model.access.csv
@@ -26,3 +26,4 @@ access_slide_slide_link_officer,slide.slide.link.officer,model_slide_slide_link,
 access_slide_slide_resource_all,slide.slide.resource.all,model_slide_slide_resource,,1,0,0,0
 access_slide_slide_resource_public,slide.slide.resource.public,model_slide_slide_resource,base.group_public,0,0,0,0
 access_slide_slide_resource_publisher,slide.slide.resource.publisher,model_slide_slide_resource,website_slides.group_website_slides_officer,1,1,1,1
+access_slide_channel_invite,access.slide.channel.invite,model_slide_channel_invite,base.group_user,1,1,1,0
diff --git a/odoo/addons/base/security/base_security.xml b/odoo/addons/base/security/base_security.xml
index 444f0148ada..f3ee7bb6cbc 100644
--- a/odoo/addons/base/security/base_security.xml
+++ b/odoo/addons/base/security/base_security.xml
@@ -68,6 +68,12 @@
             <field name="domain_force">['|',('company_id','=',False),('company_id', 'in', company_ids)]</field>
         </record>
 
+        <record id="change_password_rule" model="ir.rule">
+            <field name="name">change user password rule</field>
+            <field name="model_id" ref="model_change_password_user"/>
+            <field name="domain_force">[('create_uid', '=', user.id)]</field>
+        </record>
+
         <!-- Security restriction for private addresses -->
         <record id="res_partner_rule_private_employee" model="ir.rule">
             <field name="name">res.partner.rule.private.employee</field>
diff --git a/odoo/addons/base/security/ir.model.access.csv b/odoo/addons/base/security/ir.model.access.csv
index e1d6785f006..211e9d5485c 100644
--- a/odoo/addons/base/security/ir.model.access.csv
+++ b/odoo/addons/base/security/ir.model.access.csv
@@ -99,3 +99,23 @@
 "paperformat_access_portal","ir_actions_report_paperformat group_portal","model_report_paperformat",,1,0,0,0
 "paperformat_access_employee","ir_actions_report_paperformat group_system","model_report_paperformat",group_system,1,1,1,1
 "access_report_layout","access_report_layout","model_report_layout",,1,1,1,1
+"access_wizard_ir_model_menu_create","access.wizard.ir.model.menu.create","model_wizard_ir_model_menu_create","base.group_system",1,1,1,0
+"access_reset_view_arch_wizard","access.reset.view.arch.wizard","model_reset_view_arch_wizard","base.group_erp_manager",1,1,1,0
+"access_ir_demo","access.ir.demo","model_ir_demo","base.group_system",1,1,1,0
+"access_ir_demo_failure","access.ir.demo_failure","model_ir_demo_failure","base.group_system",1,1,1,0
+"access_ir_demo_failure_wizard","access.ir.demo_failure.wizard","model_ir_demo_failure_wizard","base.group_system",1,1,1,0
+"access_res_config","access.res.config","model_res_config","base.group_system",1,1,1,0
+"access_res_config_installer","access.res.config.installer","model_res_config_installer","base.group_system",1,1,1,0
+"access_res_config_settings","access.res.config.settings","model_res_config_settings","base.group_system",1,1,1,0
+"access_change_password_wizard","access.change.password.wizard","model_change_password_wizard","base.group_erp_manager",1,1,1,0
+"access_change_password_user","access.change.password.user","model_change_password_user","base.group_system",1,1,1,0
+"access_base_module_update","access.base.module.update","model_base_module_update","base.group_system",1,1,1,0
+"access_base_language_install","access.base.language.install","model_base_language_install","base.group_system",1,1,1,0
+"access_base_language_import","access.base.language.import","model_base_language_import","base.group_system",1,1,1,0
+"access_base_module_upgrade","access.base.module.upgrade","model_base_module_upgrade","base.group_system",1,1,1,0
+"access_base_module_uninstall","access.base.module.uninstall","model_base_module_uninstall","base.group_system",1,1,1,0
+"access_base_language_export","access.base.language.export","model_base_language_export","base.group_user",1,1,1,0
+"access_base_update_translations","access.base.update.translations","model_base_update_translations","base.group_system",1,1,1,0
+"access_base_partner_merge_line","access.base.partner.merge.line","model_base_partner_merge_line","base.group_system",1,1,1,0
+"access_base_partner_merge_automatic_wizard","access.base.partner.merge.automatic.wizard","model_base_partner_merge_automatic_wizard","base.group_system",1,1,1,0
+"access_base_document_layout","access.base.document.layout","model_base_document_layout","base.group_system",1,1,1,0
diff --git a/odoo/addons/base/views/ir_ui_view_views.xml b/odoo/addons/base/views/ir_ui_view_views.xml
index 594561a39f9..45b95be604c 100644
--- a/odoo/addons/base/views/ir_ui_view_views.xml
+++ b/odoo/addons/base/views/ir_ui_view_views.xml
@@ -129,8 +129,7 @@
             binding_model="ir.ui.view" binding_views="form"
             res_model="reset.view.arch.wizard"
             view_mode="form"
-            target="new"
-            groups="base.group_erp_manager"/>
+            target="new"/>
 
         <!-- View customizations -->
         <record id="view_view_custom_form" model="ir.ui.view">
diff --git a/odoo/addons/base/views/res_users_views.xml b/odoo/addons/base/views/res_users_views.xml
index 50008ead434..bc08c1ec562 100644
--- a/odoo/addons/base/views/res_users_views.xml
+++ b/odoo/addons/base/views/res_users_views.xml
@@ -31,8 +31,7 @@
             name="Change Password"
             binding_model="res.users"
             res_model="change.password.wizard"
-            view_mode="form" target="new"
-            groups="base.group_erp_manager"/>
+            view_mode="form" target="new"/>
 
         <!-- res.groups -->
         <record id="view_groups_search" model="ir.ui.view">
diff --git a/odoo/addons/test_new_api/security/ir.model.access.csv b/odoo/addons/test_new_api/security/ir.model.access.csv
index 5a4f8ce3239..056be62d064 100644
--- a/odoo/addons/test_new_api/security/ir.model.access.csv
+++ b/odoo/addons/test_new_api/security/ir.model.access.csv
@@ -48,3 +48,4 @@ access_test_new_api_model_binary,access_test_new_api_model_binary,model_test_new
 access_test_new_api_model_child_m2o,access_test_new_api_model_child_m2o,model_test_new_api_model_child_m2o,,1,1,1,1
 access_test_new_api_model_parent_m2o,access_test_new_api_model_parent_m2o,model_test_new_api_model_parent_m2o,,1,1,1,1
 access_test_new_api_model_private_address_onchange,access_test_new_api_model_private_address_onchange,model_test_new_api_model_private_address_onchange,base.group_user,1,1,1,1
+access_test_new_api_req_m2o_transient,access_test_new_api_req_m2o_transient,model_test_new_api_req_m2o_transient,,0,0,0,0
diff --git a/odoo/addons/test_translation_import/__manifest__.py b/odoo/addons/test_translation_import/__manifest__.py
index 73a0c450032..c6de7e12509 100644
--- a/odoo/addons/test_translation_import/__manifest__.py
+++ b/odoo/addons/test_translation_import/__manifest__.py
@@ -5,7 +5,10 @@
     'category': 'Tests',
     'description': """A module to test translation import.""",
     'depends': ['base'],
-    'data': ['view.xml'],
+    'data': [
+        'security/ir.model.access.csv',
+        'view.xml'
+    ],
     'installable': True,
     'auto_install': False,
 }
diff --git a/odoo/addons/test_translation_import/security/ir.model.access.csv b/odoo/addons/test_translation_import/security/ir.model.access.csv
new file mode 100644
index 00000000000..ba076d4035f
--- /dev/null
+++ b/odoo/addons/test_translation_import/security/ir.model.access.csv
@@ -0,0 +1,2 @@
+"id","name","model_id:id","group_id:id","perm_read","perm_write","perm_create","perm_unlink"
+"access_test_translation_import","access.test.translation.import","model_test_translation_import",,0,0,0,0