Some ir.rules have a reference to user.commercial_partner_id but this is not an attribute of res.user, this is an attribute of res.partner.
Example in base module :
<record model="ir.rule" id="res_partner_portal_public_rule">
<field name="name">res_partner: portal/public: read access on my commercial partner</field>
<field name="model_id" ref="base.model_res_partner"/>
<field name="domain_force">[('id', 'child_of', user.commercial_partner_id.id)]</field>
<field name="groups" eval="[(4, ref('base.group_portal')), (4, ref('base.group_public'))]"/>
<field name="perm_create" eval="False"/>
<field name="perm_unlink" eval="False"/>
<field name="perm_write" eval="False"/>
</record>
A correct example in portal_project :
<record id="portal_project_rule" model="ir.rule">
<field name="name">Project: portal users: public, portal or following</field>
<field name="model_id" ref="project.model_project_project"/>
<field name="domain_force">[
'|','|', ('privacy_visibility', '=', 'public'),
'&', ('privacy_visibility', '=', 'portal'),
('message_follower_ids', 'child_of', [user.partner_id.commercial_partner_id.id]),
'&',
('privacy_visibility', '=', 'followers'),
('message_follower_ids', 'in', [user.partner_id.id])
]</field>
<field name="groups" eval="[(4, ref('base.group_portal'))]"/>
</record>
The first rule should throw an error in my opinion, but it doesn't.