For example.
The amount in expense cannot be edited by internal.user.group if the status is in approved. But can still be edited by manager.group even it is in approved status.
What's happening in odoo right now is, if i tick the read-only and set a condition, "is in approved", even the administrators is affected.