Group-based access control mechanism of odoo12

Rights management is implemented through group permissions, groups are some of the records stored in res.groups inside. Permissions menu can be set by defining a set of permissions in the menu xml. model associated menu also set target level of access (read, write, create, unlink), and linked to a specific group. There are some model.py where do permission checks or xml definition set group related field.

 1 <?xml version="1.0" encoding="utf-8" ?>
 2 <odoo>
 3     <data>
 4         <record model="res.groups" id="group_manager">
 5             <field name="name">管理</field>
 6         </record>
 7         
 8         <record id="only_responsible_can_modify" model="ir.rule">
 9             <field name="name">只有课程负责人可以编辑课程</field>
10             <field name="model_id" ref="model_odoogoedu_course"/>
11             <field name="groups" eval="[(4, ref('odoogoedu.group_manager'))]"/>
12             <field name="perm_read" eval="0"/>
13             <field name="perm_write" eval="1"/>
14             <field name="perm_create" eval="0"/>
15             <field name="perm_unlink" eval="1"/>
16             <field name="domain_force">
17                 ['|', ('responsible_id','=',False),
18                       ('responsible_id','=',user.id)]
19             </field>
20         </record>
21     </data>
22 </odoo>