Security rules are added in the sale module for transactions and tokens, but it is entirely possible to have the payment module without those, and preventing invcoicing users from accessing transactions is functionnaly stupid - they are often required to check payment statuses, references, etc. closes odoo/odoo#52139 Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>