resource.calendar.leaves: employee reads own or global ['|', ('resource_id', '=', False), ('resource_id.user_id', 'in', [False, user.id])] resource.calendar.leaves: employee modifies own [('resource_id', '!=', False), ('resource_id.user_id', 'in', [False, user.id])] resource.calendar.leaves: admin modifies global [('resource_id', '=', False)]