I know I can completly limit the access to a group with a record like this
<record id="limit_all_access_rule" model="ir.rule">
<field name="name">Limit all access</field>
<field ref="model_my_model" name="model_id"/>
<field name="domain_force">[('state','=','SV')]</field>
<field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
</record>
With this rule the Salesman group can access only the record in the SV state and can't see record in any other state
How can I modify this to make the Salesman group to have readonly access to all record and can write only when in SV state ?