diff --git a/addons/sale/security/sale_security.xml b/addons/sale/security/sale_security.xml
index 454a93ffb37..a789b1798a6 100644
--- a/addons/sale/security/sale_security.xml
+++ b/addons/sale/security/sale_security.xml
@@ -59,6 +59,21 @@
         <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
     </record>
 
+    <!-- Payments -->
+    <record id="payment_transaction_salesman_rule" model="ir.rule">
+        <field name="name">Access every payment transaction</field>
+        <field name="model_id" ref="payment.model_payment_transaction"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
+    </record>
+
+    <record id="payment_token_salesman_rule" model="ir.rule">
+        <field name="name">Access every payment token</field>
+        <field name="model_id" ref="payment.model_payment_token"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
+    </record>
+
     <!-- Portal Access Rules -->
     <record id="sale_order_rule_portal" model="ir.rule">
         <field name="name">Portal Personal Quotations/Sales Orders</field>
diff --git a/addons/website_sale/security/website_sale.xml b/addons/website_sale/security/website_sale.xml
index 0af26e6d7d7..490098ba375 100644
--- a/addons/website_sale/security/website_sale.xml
+++ b/addons/website_sale/security/website_sale.xml
@@ -23,6 +23,7 @@
         <field name="perm_unlink" eval="False"/>
     </record>
 
+    <!-- TODO: remove in master -->
     <record id="payment_transaction_salesman_rule" model="ir.rule">
         <field name="name">Access every payment transaction</field>
         <field name="model_id" ref="payment.model_payment_transaction"/>
@@ -30,6 +31,7 @@
         <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
     </record>
 
+    <!-- TODO: remove in master -->
     <record id="payment_token_salesman_rule" model="ir.rule">
         <field name="name">Access every payment token</field>
         <field name="model_id" ref="payment.model_payment_token"/>