diff --git a/addons/base_setup/res_config_view.xml b/addons/base_setup/res_config_view.xml
index 6067af0ca52..a18fbce50e4 100644
--- a/addons/base_setup/res_config_view.xml
+++ b/addons/base_setup/res_config_view.xml
@@ -114,7 +114,7 @@
             <field name="view_mode">form</field>
             <field name="target">inline</field>
         </record>
-        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration"/>
+        <menuitem id="base.menu_config" name="General Settings" parent="base.menu_administration" sequence="1" action="action_general_configuration" groups="base.group_system"/>
 
 
         <!-- Sale config wizard -->
diff --git a/addons/web_settings_dashboard/views/dashboard_views.xml b/addons/web_settings_dashboard/views/dashboard_views.xml
index 3bf85772f4b..2a051860708 100644
--- a/addons/web_settings_dashboard/views/dashboard_views.xml
+++ b/addons/web_settings_dashboard/views/dashboard_views.xml
@@ -4,5 +4,5 @@
         <field name="name">Dashboard</field>
         <field name="tag">web_settings_dashboard.main</field>
     </record>
-    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" />
+    <menuitem name="Dashboard" id="web_dashboard_menu" action="web_settings_dashboard_action" parent="base.menu_administration" sequence="-1" groups="base.group_system"/>
 </odoo>
diff --git a/openerp/addons/base/base_menu.xml b/openerp/addons/base/base_menu.xml
index e8e33230148..bdacce6ff4c 100644
--- a/openerp/addons/base/base_menu.xml
+++ b/openerp/addons/base/base_menu.xml
@@ -11,7 +11,7 @@
           icon="fa-cog"
           web_icon="base,static/description/settings.png"
           sequence="500"
-          groups="base.group_system"/>
+          groups="base.group_erp_manager"/>
           <menuitem id="menu_management" name="Apps" sequence="310" web_icon="base,static/description/modules.png" groups="base.group_system"/>
           <menuitem id="menu_administration_shortcut" parent="menu_administration" name="Custom Shortcuts" sequence="50"/>
           <menuitem id="menu_users" name="Users" parent="menu_administration" sequence="0"/>
diff --git a/openerp/addons/base/res/res_security.xml b/openerp/addons/base/res/res_security.xml
index a5f7550492c..35c0c5e4521 100644
--- a/openerp/addons/base/res/res_security.xml
+++ b/openerp/addons/base/res/res_security.xml
@@ -11,12 +11,26 @@
             <field eval="[(6,0,[ref('group_system'), ref('group_partner_manager')])]" name="groups_id"/>
         </record>
 
-        <!-- Record Rule For Company -->
-        <record id="res_company_rule" model="ir.rule">
-            <field name="name">company rule</field>
+        <!-- Record Rules For Company -->
+        <record id="res_company_rule_portal" model="ir.rule">
+            <field name="name">company rule portal</field>
             <field name="model_id" ref="model_res_company"/>
-            <field eval="True" name="global"/>
-            <!-- TODO: review this <field name="domain_force">['|', ('child_ids', 'child_of', [user.company_id.id]), ('parent_id', 'child_of', [user.company_id.id])]</field> -->
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_portal')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_employee" model="ir.rule">
+            <field name="name">company rule employee</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_user')])]"/>
+            <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
+        </record>
+        <record id="res_company_rule_public" model="ir.rule">
+            <field name="name">company rule public</field>
+            <field name="model_id" ref="model_res_company"/>
+            <field eval="False" name="global"/>
+            <field name="groups" eval="[(6, 0, [ref('base.group_public')])]"/>
             <field name="domain_force">[('id','child_of',[user.company_id.id])]</field>
         </record>
 
diff --git a/openerp/addons/base/res/res_users.py b/openerp/addons/base/res/res_users.py
index 00f30c4bc83..c657e3ba847 100644
--- a/openerp/addons/base/res/res_users.py
+++ b/openerp/addons/base/res/res_users.py
@@ -183,7 +183,7 @@ class Users(models.Model):
         return (default_user or self.env['res.users']).groups_id
 
     def _companies_count(self):
-        return self.env['res.company'].search_count([])
+        return self.env['res.company'].sudo().search_count([])
 
     partner_id = fields.Many2one('res.partner', required=True, ondelete='restrict', auto_join=True,
         string='Related Partner', help='Partner-related data of the user')
@@ -674,7 +674,8 @@ class GroupsView(models.Model):
     @api.multi
     def write(self, values):
         res = super(GroupsView, self).write(values)
-        self._update_user_groups_view()
+        if 'category_id' in values:
+            self._update_user_groups_view()
         # ir_values.get_actions() depends on action records
         self.env['ir.values'].clear_caches()
         return res
diff --git a/openerp/addons/base/security/ir.model.access.csv b/openerp/addons/base/security/ir.model.access.csv
index 21a18587c18..1736580b147 100644
--- a/openerp/addons/base/security/ir.model.access.csv
+++ b/openerp/addons/base/security/ir.model.access.csv
@@ -17,7 +17,7 @@
 "access_ir_model_data_all","ir_model_data all","model_ir_model_data",,1,0,0,0
 "access_ir_model_data_user","ir_model_data user","model_ir_model_data",base.group_user,1,0,1,0
 "access_ir_model_fields_all","ir_model_fields all","model_ir_model_fields",,1,0,0,0
-"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_system",1,0,0,0
+"access_ir_module_category_group_user","ir_module_category group_user","model_ir_module_category","group_erp_manager",1,0,0,0
 "access_ir_module_module_group_user","ir_module_module group_user","model_ir_module_module","group_system",1,1,1,1
 "access_ir_module_module_dependency_group_system","ir_module_module_dependency group_system","model_ir_module_module_dependency","group_system",1,1,1,1
 "access_ir_property_group_user","ir_property group_user","model_ir_property",,1,0,0,0
diff --git a/openerp/addons/base/tests/test_ir_rule.yml b/openerp/addons/base/tests/test_ir_rule.yml
index 82e8b0c14a7..02fc2e3d3b4 100644
--- a/openerp/addons/base/tests/test_ir_rule.yml
+++ b/openerp/addons/base/tests/test_ir_rule.yml
@@ -124,7 +124,7 @@
     Modify the global rule on res_company which triggers a recursive check
     of the rules on company.
 -
-    !record {model: ir.rule, id: res_company_rule}:
+    !record {model: ir.rule, id: res_company_rule_employee}:
         domain_force: "[('id','child_of',[user.company_id.id])]"
 -
     Read as demo user the partners (exercising the global company rule).