Nope.

NameError: name 'user_permission' is not defined

you can take another approach,

add one more field in your model:

_columns = {
    'is_editable': fields.function(_is_editable, type='boolean', string="Can Be Edited"), 
    ...
}

implement _is_editable -function in your model that will calculate is_editable field according your requirements. 

then in xml, use is_editable field as follows:

<field name="is_editable" invisible="1"/>
<field name="product_id" attrs="{'readonly':[('is_editable','=',False)]}"/> 

cheers.