Hi Niyas, thanks for your reply. I tried but it turns out that I can limit access to uploading files, but they are still readable, so anybody can open them. I also experienced that these rules are applied globally across all modules, so restricting a user to upload in purchase will also forbid him to upload on a sale order and create pdf reports there. There is also the access right 'ir_attachment all' which gives reading rights to an undefined group. If I disable that, the site won't even load and remain white for the regular user not having ir.attachment access. I wonder if that causes the always read issue.