This might be what is causing your problem.  Odoo 12 introduced a Record Rule that was designed to limit access to “private addresses”. It’s on the Contacts model (res.partner).

There are a pair of Record Rules:

1.  Allow access to “private addresses” for selected users

[('type', '=', 'private')]

2. Allow access for all users to other “non-private addresses”

['|', 
  ('type', '!=', 'private'), 
  ('type', '=',   False)
]

This Record Rule grants access to all internal users through the “Internal User” access group. This group is inherited by all application access groups.

The problem is that the second Record Rule effectively overrides other Record Rules for Contacts.

• If you have created a Record Rules to limit access to suppliers:
  • a user who should not have access to suppliers would be granted access (because type will be blank).
    • They would also be able to access private addresses for customers and other types of contact!

That’s because access is granted if the conditions for ANY of the Group-specific rules are satisfied – and these can come from multiple access groups.

The solution is either to remove the two “private address” Record Rules or to replace them with several rules that cover all the combinations.

This would also explain why a global record rule would work.

https://odootricks.tips/record-rules