Articles: System = CRUD on all articles [(1, '=', 1)] Articles: users/portal: read based on access [('user_has_access', '=', True)] Articles: users/portal: write based on flag [('user_has_write_access', '=', True)] Article members: users: read article members [('article_id.user_has_access', '=', True)] Article members: portal: read own article members [('partner_id', '=', user.partner_id.id), ('article_id.user_has_access', '=', True)] Article members: System CRUD all [(1,'=',1)] Article favorite: users/portal: own + readable articles [('user_id', '=', user.id), ('article_id.user_has_access', '=', True)] Article favorite: System CRUD all [(1, '=', 1)] Invite: System invite members [('article_id.user_has_write_access', '=', True)]