resource.calendar.leaves: employee reads own or global ['|', ('resource_id', '=', False), ('resource_id.user_id', '=', user.id)] resource.calendar.leaves: employee modifies own [('resource_id.user_id', '=', user.id)]