social/mass_mailing_security_group/security/mail_mass_mailing_security.xml

<?xml version="1.0" encoding="utf-8"?>
<odoo noupdate="1">

        <record id="mass_mailing_marketing_user_access" model="ir.rule">
            <field name="name">Marketing user - Delete own unsent mass mailings</field>
            <field name="model_id" ref="mass_mailing.model_mail_mass_mailing"/>
            <field name="domain_force">[('create_uid', '=', user.id), ('state', 'in', ('draft', 'test'))]</field>
            <field name="groups" eval="[(4, ref('marketing.group_lead_automation_user'))]"/>
            <field eval="0" name="perm_read"/>
            <field eval="0" name="perm_write"/>
            <field eval="0" name="perm_create"/>
            <field eval="1" name="perm_unlink"/>
        </record>

        <record id="mass_mailing_marketing_manager_access" model="ir.rule">
            <field name="name">Marketing manager - Delete all unsent mass mailings</field>
            <field name="model_id" ref="mass_mailing.model_mail_mass_mailing"/>
            <field name="domain_force">[('state', 'in', ('draft', 'test'))]</field>
            <field name="groups" eval="[(4, ref('marketing.group_lead_automation_manager'))]"/>
            <field eval="0" name="perm_read"/>
            <field eval="0" name="perm_write"/>
            <field eval="0" name="perm_create"/>
            <field eval="1" name="perm_unlink"/>
        </record>

</odoo>