suite/hr_commission/security/commission_security.xml

<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <data noupdate="0">

        <record id="hr_commission_rule" model="ir.rule">
            <field name="name">Commission User</field>
            <field name="model_id" ref="model_hr_commission"/>
            <field name="domain_force">[('user_id', '=', user.id)]</field>
            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
        </record>

        <record id="hr_commission_rule_manager" model="ir.rule">
            <field name="name">Commission Manager</field>
            <field name="model_id" ref="model_hr_commission"/>
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="groups" eval="[(4, ref('account.group_account_manager'))]"/>
        </record>

        <record id="hr_commission_payment_rule" model="ir.rule">
            <field name="name">Commission Payment User</field>
            <field name="model_id" ref="model_hr_commission_payment"/>
            <field name="domain_force">[('user_id', '=', user.id)]</field>
            <field name="groups" eval="[(4, ref('base.group_user'))]"/>
        </record>

        <record id="hr_commission_payment_rule_manager" model="ir.rule">
            <field name="name">Commission Payment Manager</field>
            <field name="model_id" ref="model_hr_commission_payment"/>
            <field name="domain_force">[(1, '=', 1)]</field>
            <field name="groups" eval="[(4, ref('account.group_account_manager'))]"/>
        </record>

    </data>
</odoo>