diff --git a/sign_oca/__manifest__.py b/sign_oca/__manifest__.py
index d07edb5d..5c7293fa 100644
--- a/sign_oca/__manifest__.py
+++ b/sign_oca/__manifest__.py
@@ -11,6 +11,7 @@
     "website": "https://github.com/OCA/sign",
     "depends": ["web_editor", "portal", "base_sparse_field"],
     "data": [
+        "security/security.xml",
         "views/menu.xml",
         "data/data.xml",
         "wizards/sign_oca_template_generate.xml",
diff --git a/sign_oca/security/ir.model.access.csv b/sign_oca/security/ir.model.access.csv
index 261864b6..fdbc87d4 100644
--- a/sign_oca/security/ir.model.access.csv
+++ b/sign_oca/security/ir.model.access.csv
@@ -1,10 +1,9 @@
 id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
-edit_sign_template,edit_sign_template,model_sign_oca_template,base.group_system,1,1,1,1
-edit_sign_template_item,edit_sign_template_item,model_sign_oca_template_item,base.group_system,1,1,1,1
-edit_sign_role,edit_sign_role,model_sign_oca_role,base.group_system,1,1,1,1
-edit_sign_field,edit_sign_field,model_sign_oca_field,base.group_system,1,1,1,1
-edit_sign_request,edit_sign_field,model_sign_oca_request,base.group_system,1,1,1,1
-edit_sign_request_field,edit_sign_field,model_sign_oca_request_field,base.group_system,1,1,1,1
-edit_sign_request_signer,edit_sign_field,model_sign_oca_request_signer,base.group_system,1,1,1,1
-edit_sign_generate,edit_sign_field,model_sign_oca_template_generate,base.group_system,1,1,1,1
-edit_sign_generate_signer,edit_sign_field,model_sign_oca_template_generate_signer,base.group_system,1,1,1,1
+edit_sign_template,edit_sign_template,model_sign_oca_template,sign_oca_group_user,1,1,1,1
+edit_sign_template_item,edit_sign_template_item,model_sign_oca_template_item,sign_oca_group_user,1,1,1,1
+edit_sign_role,edit_sign_role,model_sign_oca_role,sign_oca_group_user,1,1,1,1
+edit_sign_field,edit_sign_field,model_sign_oca_field,sign_oca_group_user,1,1,1,1
+edit_sign_request,edit_sign_field,model_sign_oca_request,sign_oca_group_user,1,1,1,1
+edit_sign_request_signer,edit_sign_field,model_sign_oca_request_signer,sign_oca_group_user,1,1,1,1
+edit_sign_generate,edit_sign_field,model_sign_oca_template_generate,sign_oca_group_user,1,1,1,1
+edit_sign_generate_signer,edit_sign_field,model_sign_oca_template_generate_signer,sign_oca_group_user,1,1,1,1
diff --git a/sign_oca/security/security.xml b/sign_oca/security/security.xml
new file mode 100644
index 00000000..bcbdb1ac
--- /dev/null
+++ b/sign_oca/security/security.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<odoo>
+    <!-- Application -->
+    <record id="sign_oca_module_category" model="ir.module.category">
+        <field name="name">Sign</field>
+    </record>
+     <!-- Access Groups -->
+     <record id="sign_oca_group_user" model="res.groups">
+        <field name="name">User: Own Documents Only</field>
+        <field name="category_id" ref="sign_oca_module_category" />
+        <field name="implied_ids" eval="[(4, ref('base.group_user'))]" />
+    </record>
+    <record id="sign_oca_group_manager" model="res.groups">
+        <field name="name">User: All Documents</field>
+        <field name="category_id" ref="sign_oca_module_category" />
+        <field name="implied_ids" eval="[(4, ref('sign_oca_group_user'))]" />
+        <field
+            name="users"
+            eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"
+        />
+    </record>
+</odoo>