pim_security.xml

<?xml version="1.0" encoding="utf-8" ?>
<!-- Copyright 2020 Akretion
     License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl). -->
<odoo>
    <record id="group_pim_reader" model="res.groups">
        <field name="name">Reader</field>
        <field name="category_id" ref="pim.module_category_pim" />
        <field name="comment">
            the user will have only the right to consult the products catalogue
        </field>
    </record>
    <record id="group_pim_user" model="res.groups">
        <field name="name">User</field>
        <field name="category_id" ref="pim.module_category_pim" />
        <field name="implied_ids" eval="[(4, ref('group_pim_reader'))]" />
        <field name="comment">
            the user will be able to modify products but will not be authorized to
            create attributes
        </field>
    </record>
    <record id="group_pim_manager" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="pim.module_category_pim" />
        <field name="implied_ids" eval="[(4, ref('group_pim_user'))]" />
        <field name="users" eval="[(4, ref('base.user_admin'))]" />
        <field name="comment">
            the user will be able to modify products and create attributes
        </field>
    </record>
</odoo>