Odoo access rights vs record rules: which one do you need?

Two layers, two questions.

Access rights (ir.model.access.csv)

Question: can this group read, write, create or delete this model at all?

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_x_user,x.user,model_x,base.group_user,1,0,0,0
access_x_mgr,x.manager,model_x,my.group_mgr,1,1,1,1

No line for a group means no access. Forgetting this file is why a new model shows “You are not allowed to access”.

Record rules (ir.rule)

Question: which rows can this group see?

<record id="rule_x_own" model="ir.rule">
    <field name="name">X: own records</field>
    <field name="model_id" ref="model_x"/>
    <field name="domain_force">[('user_id', '=', user.id)]</field>
    <field name="groups" eval="[(4, ref('base.group_user'))]"/>
</record>

The trap

Rules with no group apply to everyone, including admin-like roles. Rules for the same model and different groups are OR-ed, global rules are AND-ed.

Check

Log in as a test user per role and open the list view. Do not trust a check done as admin, because the superuser bypasses rules.