Hi,

For creating new security groups and access right in odoo 13 use the blog below

https://www.cybrosys.com/blog/how-to-create-security-group-odoo-13  

For changing the access rights of already existing models visit the similar forum post before

https://www.odoo.com/forum/help-1/question/how-to-change-existing-access-right-of-some-model-in-a-ir-model-access-csv-82976

Hope it helps

Hi,

If you need to show the employee attendance to the employee users, you can just add the rules like this,

<record id="hr_attendance_personal_rule" model="ir.rule">
    <field name="name">Employee Attendance View</field>
    <field ref="hr_attendance.model_hr_attendance" name="model_id"/>
    <field name="domain_force">['|',('employee_id.user_id','=',user.id),('employee_id.user_id','=',False)]</field>
    <field name="groups" eval="[(4, ref('base.group_user'))]"/>
</record>

<record id="hr_attendance.menu_hr_attendance_manage_attendances" model="ir.ui.menu">
    <field eval="[(4,ref('hr.group_hr_attendance'))]" name="groups_id"/>
</record>

<record id="hr_attendance.menu_hr_attendance_view_attendances" model="ir.ui.menu">
    <field eval="[(4,ref('hr.group_hr_attendance'))]" name="groups_id"/>
</record>

The above code is of v10, as same or with some adjustments you can use same in v13 also.

Also there is a module for the same in Odoo10, you can try to  migrate it to v13, see: https://apps.odoo.com/apps/modules/10.0/hr_employee_attendance/

Also if you like to understand how the security(access rights , record rules and group) work in odoo, see this: https://www.youtube.com/watch?v=mzg3EGD_6Gw

Thanks