You can carry out two types of control on journals in Odoo – controls over the accounts and access controls for groups of users. In addition to these controls, you can also apply all of the standard user rights management.

To avoid entering account data in the wrong accounts, you can put conditions on the general accounts about which journal can use a given account. To do this, you have to list all the accounts or valid account types in the second tab, Control-Access. If you have not added any accounts there, Odoo applies no restriction on the accounts for that journal. If you list accounts and/or the types of accounts that can be used in a journal, Odoo prevents you from using any account or account type not in that list. This verification step starts from the moment you enter data. You can only select allowed accounts or account types.

This functionality is useful for limiting possible data entry errors by restricting the accounts to be used in a journal.

Example:

Review the Control-Access configuration (when Developer Mode is activated) that locks down which Accounts and Accounts can be posted to:

Users can only select "valid" Journals on Accounting Documents (Invoices, Bills, Receipts, Payments).  For example, Vendor Bills only allow the selection of "purchase" Journal Types:

Between the restrictions of which Journals users can choose, and which accounts and account types they can post to, most GL Security policies can be easily implemented.

To restrict users from editing only those Manual Journal Entries they created, use a record rule:

Something that allows editing if the Journal is not Manual and the User is the Creator:

['|',('journal_id.type','!=','general'),('create_uid', '=', user.id)]