How to configure flexible access rules

BASIC PROBLEM TO SOLVE

I am trying to configure flexible rules using user groups and ir.rules in Odoo 10. Basically I want to give users access only to certain records, based on specific values in columns. There are some records that I want to restrict - regardless if it was allowed in another group based on different criteria.

Here are some simplified examples of what I want to accomplish:

1.

(country = 'USA'
or
office= London)

and

vip = false

2.

(country = 'uk'
or
country = 'netherlands'
or
office = London)

etc

To make the access rules flexible, I want to create the following groups:

• group_country_usa
• group_country_germany
• group_country_uk
• group_country_netherlands

etc

• group_office_london
• group_office_new_york
• group_office_paris
• group_office_tokyo
• group_office_st_petersburg

etc

• group_no_vips

I have corresponding ir.rules records for each group above:

[('country','=', 'usa')]
etc

[('office','=', 'amsterdam')]
etc

[('vip','=', False)]

Per my testing I do not believe I can do the the above with only using separate ir.rules records.

Is there a way I can accomplish my objective?

I hope the above makes sense and that someone can hint me in the right direction.

Assuming there's a global rule allowing access to all records, I see no problem with using your described ir.rule and res.groups configuration. However, group rules are additive, meaning it is not possible to join ir.rule domains with and like in your example #1. See official docs for more information.