odoo/addons/hr_expense/security/ir_rule.xml

<?xml version="1.0" ?>
<openerp>
    <data noupdate="1">

        <record id="property_rule_expense" model="ir.rule">
            <field name="name">Employee Expense</field>
            <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
            <field name="groups" eval="[(4,ref('base.group_hr_user'))]"/>
        </record>
        <record id="property_rule_expense_manager" model="ir.rule">
            <field name="name">Manager Expense</field>
            <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
            <field name="domain_force">[(1,'=',1)]</field>
            <field name="groups" eval="[(4,ref('base.group_hr_manager'))]"/>
        </record>
        <record id="property_rule_expense_employee" model="ir.rule">
            <field name="name">Employee Expense</field>
            <field model="ir.model" name="model_id" ref="model_hr_expense_expense"/>
            <field name="domain_force">[('employee_id.user_id','=',user.id)]</field>
            <field name="groups" eval="[(4,ref('base.group_user'))]"/>
        </record>

    </data>
</openerp>