Comment 7 for bug 397741

> This is not comparable with the views or the model data. Here, we may be
> want to reset everything in every upgrade.

It is comparable. If you create or update objects on new versions (add
links to others objects, for example), you will have to create or update
access rights too.

If we set access rights as non-updateable, create will work but not
update. (think about a sale order that generates or updates picking lists).

The problem is exactly the same than the view editor:
* if you change a view, you have to do an inherit or record in a module,
otherwise you may lose your changes at next update.

For access rights:
* record them in a module (quite easy with module recorder because you
don't need to record anymore but can save afterwards) or
* create new groups/rules for what you want to change.

I understand it is frustrating to lose your changes, but I think it's
also critical to have two users on 5.2.0 having a different
configuration, because one migrated from v5.0.0 and the other one
installed v5.2.0 directly. Just think about how complex can be to manage
these side effects after several migrations.

I still don't know which solution is the best one.

But, for me, it's exactly the same problem than the view editor. So we
must keep like that or change both at once, but not change the access
rights only.