contract/agreement_legal/security/res_groups.xml

<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <record id="module_agreement_legal_category" model="ir.module.category">
        <field name ="name">Agreement</field>
        <field name ="sequence">17</field>
   </record>

    <!-- Readonly group -->
    <record id="group_agreement_readonly" model="res.groups">
        <field name="name">Read-Only Users</field>
        <field name="category_id" ref="module_agreement_legal_category"/>
        <field name="implied_ids" eval="[(4, ref('base.group_user')), (4, ref('agreement.group_use_agreement_type')), (4, ref('agreement.group_use_agreement_template'))]"/>
    </record>

    <!-- User group -->
    <record id="group_agreement_user" model="res.groups">
        <field name="name">User</field>
        <field name="category_id" ref="module_agreement_legal_category"/>
        <field name="implied_ids" eval="[(4, ref('group_agreement_readonly'))]"/>
    </record>

    <!-- Manager group -->
    <record id="group_agreement_manager" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="module_agreement_legal_category"/>
        <field name="implied_ids" eval="[(4, ref('group_agreement_user'))]"/>
        <field name="users" eval="[(4, ref('base.user_root')), (4, ref('base.user_admin'))]"/>
    </record>

</odoo>