Hi,

In Odoo, access rights are cumulative, meaning if a user belongs to multiple groups, they automatically inherit the highest level of permission from any of those groups. This is why your read-only access rules didn’t work, the users still had full rights inherited from existing rules defined in other modules.

To fix this, you first need to remove the existing ACLs for the stock.landed.cost model. You can do this in your custom module by adding <delete> tags in a security.xml file to delete the default access rules provided by the stock or accounting modules. After deleting the default rules, you can then define new access control entries in your ir.model.access.csv file that grant read-only permissions (1,0,0,0) to the three groups — Accounting / Accountant, Accounting / Chief Accountant, and Inventory / Administrator.

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

access_stock_landed_cost_readonly_accountant,stock.landed.cost.readonly.accountant,stock_landed_costs.model_stock_landed_cost,account.group_account_manager,1,0,0,0

access_stock_landed_cost_readonly_chief_accountant,stock.landed.cost.readonly.chief_accountant,stock_landed_costs.model_stock_landed_cost,base_accounting_kit.group_account_accountant,1,0,0,0

access_stock_landed_cost_readonly_inventory_admin,stock.landed.cost.readonly.inventory.admin,stock_landed_costs.model_stock_landed_cost,stock.group_stock_manager,1,0,0,0

Next, if you need a specific group with full access to manage landed costs, you can create a new custom group (e.g., “Landed Cost Manager”) and assign it full permissions (1,1,1,1) on the same model.

<record id="group_landed_cost_manager" model="res.groups">

    <field name="name">Landed Cost Manager</field>

    <field name="category_id" ref="base.module_category_inventory"/>

</record>

access_stock_landed_cost_full_access,stock.landed.cost.full.access,stock_landed_costs.model_stock_landed_cost,my_module.group_landed_cost_manager,1,1,1,1

Finally, you should upgrade your module (not just restart the server) so Odoo properly reloads the updated ACLs. This approach ensures your existing groups have read-only access, while your new group retains full control over landed cost records.

If access rights alone don't work, add record rules in your security file:

<!-- Read-only rule for Accountants -->

<record id="stock_landed_cost_readonly_accountant_rule" model="ir.rule">

    <field name="name">Landed Cost - Read Only for Accountants</field>

    <field name="model_id" ref="stock_landed_costs.model_stock_landed_cost"/>

    <field name="domain_force">[(1, '=', 1)]</field>

    <field name="groups" eval="[(4, ref('account.group_accountant'))]"/>

    <field name="perm_read" eval="True"/>

    <field name="perm_write" eval="False"/>

    <field name="perm_create" eval="False"/>

    <field name="perm_unlink" eval="False"/>

</record>

<!-- Repeat for other groups -->

<record id="stock_landed_cost_readonly_account_manager_rule" model="ir.rule">

    <field name="name">Landed Cost - Read Only for Chief Accountants</field>

    <field name="model_id" ref="stock_landed_costs.model_stock_landed_cost"/>

    <field name="domain_force">[(1, '=', 1)]</field>

    <field name="groups" eval="[(4, ref('account.group_account_manager'))]"/>

    <field name="perm_read" eval="True"/>

    <field name="perm_write" eval="False"/>

    <field name="perm_create" eval="False"/>

    <field name="perm_unlink" eval="False"/>

</record>

<record id="stock_landed_cost_readonly_stock_manager_rule" model="ir.rule">

    <field name="name">Landed Cost - Read Only for Stock Managers</field>

    <field name="model_id" ref="stock_landed_costs.model_stock_landed_cost"/>

    <field name="domain_force">[(1, '=', 1)]</field>

    <field name="groups" eval="[(4, ref('stock.group_stock_manager'))]"/>

    <field name="perm_read" eval="True"/>

    <field name="perm_write" eval="False"/>

    <field name="perm_create" eval="False"/>

    <field name="perm_unlink" eval="False"/>

</record>

Hope it helps