The security rules we want to add in this recipe are as follows:

• Everyone will be able to read library book records.
• A new group of users called Librarians will have the right to create, read, update, and delete book records.

To implement this, you need to perform the following steps:

1. Create a file called security/groups.xml with the following content:

<?xml version="1.0" encoding="utf-8"?>
<odoo>
  <record id="group_librarian" model="res.groups">
    <field name="name">Librarians</field>
    <field name="users" eval="[(4, ref('base.user_admin'))]"/>
  </record>
</odoo>

2. Add a file called security/ir.model.access.csv with the following content:

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
acl_book,library.book default,model_library_book,,1,0,0,0
acl_book_librarian,library.book_librarian,model_library_book,group_librarian,1,1,1,1

3. Add both files in the data entry of __manifest__.py:

# ... 
 'data': [
     'security/groups.xml',
     'security/ir.model.access.csv',
     'views/library_book.xml'
 ],
 # ...

The newly defined security rules will be in place once you update the add-on in your instance.