I don't know what you written in ir.model.access.csv file. but, i think you need to set access rights like this,

id,name,model_id/id,group_id/id,perm_read,perm_write,perm_create,perm_unlink
course_administrator,course manager,model_security_model_model1,group_manager,1,1,1,1
course_create_only_users,course all,model_security_model_model1,,1,0,1,1

and don't forget to put administrator users in group_manager.

Hi, thanks for your aswer.

I think you are suggesting to define a global ir.model.access row "course_create_only_users" without write permission on "course" model, so by default no user can edit courses.

Than a group_manager's ir.model.access row "course_administrator" with all RWCD rights, so the users into the group_manager can edit courses.

That is right, but doesn't apply to my question.

My problem is that I can't define the W right based on group. I need a record rule that restrict the W access based on single record. For instance suppose that the users into the group_manager, ie the teachers, can edit its own courses only, so I need to define a record rule on model course like "[('teacher_id', '=', user.id)].

The rule blocks the Write operation if the current user is not the teacher_id of the course, but in the detail view of the course the user can see the edit button and he can click on it and only after Save action it will appears the "The requested operation cannot be completed due to security restrictions" error.

That is not a good ux!