Can only read messages that you sent or messages sent to you ["|", ('to_id.user', '=', user.id), ('from_id.user', '=', user.id)] Can only modify your user [('user', '=', user.id)]