[ADD] base_tier_validation: dedicated manager group, menu out of Technical

base_tier_validation/__manifest__.py

@@ -15,6 +15,7 @@
     "depends": ["mail"],
     "data": [
         # Security
+        "security/tier_validation_groups.xml",
         "security/ir.model.access.csv",
         "security/tier_validation_security.xml",
         # Data

base_tier_validation/readme/CONFIGURE.md

@@ -1,10 +1,16 @@
 To configure this module, you need to:
 
-1.  Go to *Settings \> Technical \> Tier Validations \> Tier
-    Definition*.
+1.  Go to *Tier Validations \> Tier Definition* (top-level menu, no
+    Settings / Technical access required).
 2.  Create as many tiers as you want for any model having tier
     validation functionality.
 
+The *Tier Validations* menu is gated by the **Tier Validation
+Administrator** group. Assign it to trusted key users (Settings \>
+Users \> *Tier Validation* category) so they can manage definitions and
+exceptions **without** granting them Settings / Technical access.
+System administrators receive this group automatically.
+
 **Note:**
 
 - If check *Notify Reviewers on Creation*, all possible reviewers will

base_tier_validation/readme/HISTORY.md

@@ -1,3 +1,14 @@
+## 19.0.2.0.0 (2026-05-17)
+
+Features:
+
+- New **Tier Validation Administrator** security group. Trusted key
+  users can now manage tier definitions and exceptions without being
+  granted Settings / Technical access. System administrators receive
+  the group automatically (back-compat).
+- The *Tier Validations* menu has moved out of *Settings > Technical*
+  to a top-level menu, gated by the new group.
+
 ## 19.0.1.0.1 (2026-05-12)
 
 Fixes:

base_tier_validation/security/ir.model.access.csv

@@ -9,3 +9,6 @@ access_tier_definition_settings,tier.definition.settings,model_tier_definition,b
 access_comment_wizard,access.comment.wizard,model_comment_wizard,base.group_user,1,1,1,1
 access_tier_validation_exceptions_all,tier.validation.exceptions,model_tier_validation_exception,base.group_user,1,0,0,0
 access_tier_validation_exceptions_settings,tier.validation.exceptions,model_tier_validation_exception,base.group_system,1,1,1,1
+access_tier_definition_manager,tier.definition.manager,model_tier_definition,base_tier_validation.group_tier_validation_manager,1,1,1,1
+access_tier_validation_exceptions_manager,tier.validation.exceptions.manager,model_tier_validation_exception,base_tier_validation.group_tier_validation_manager,1,1,1,1
+access_tier_review_manager,tier.review.manager,model_tier_review,base_tier_validation.group_tier_validation_manager,1,1,1,1

base_tier_validation/security/tier_validation_groups.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!-- Copyright 2026 ForgeFlow S.L. (https://www.forgeflow.com)
+     License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl). -->
+<odoo noupdate="0">
+    <record id="module_category_tier_validation" model="ir.module.category">
+        <field name="name">Tier Validation</field>
+        <field name="sequence">20</field>
+    </record>
+    <record id="privilege_tier_validation" model="res.groups.privilege">
+        <field name="name">Tier Validation</field>
+        <field name="category_id" ref="module_category_tier_validation" />
+    </record>
+    <record id="group_tier_validation_manager" model="res.groups">
+        <field name="name">Administrator</field>
+        <field name="privilege_id" ref="privilege_tier_validation" />
+    </record>
+    <!-- Back-compat: system administrators keep full access and still see
+         the (now top-level) Tier Validations menu. -->
+    <record id="base.group_system" model="res.groups">
+        <field
+            name="implied_ids"
+            eval="[(4, ref('base_tier_validation.group_tier_validation_manager'))]"
+        />
+    </record>
+</odoo>

base_tier_validation/tests/test_tier_validation.py

@@ -7,9 +7,9 @@
 from lxml import etree
 
 from odoo import Command
-from odoo.exceptions import ValidationError
+from odoo.exceptions import AccessError, ValidationError
 from odoo.fields import Domain
-from odoo.tests import Form
+from odoo.tests import Form, new_test_user
 from odoo.tests.common import tagged
 
 from ..models.tier_validation import BASE_EXCEPTION_FIELDS as BEF
@@ -1454,6 +1454,38 @@ def test_34_test_duplicate_new_user_should_not_have_review_ids(self):
         # Review_ids should not be copied when duplicating a user
         self.assertFalse(new_user.review_ids.ids)
 
+    def test_35_manager_group_can_configure_without_technical(self):
+        """A trusted key user holding only the Tier Validation
+        Administrator group (no system / erp_manager / Technical) can
+        manage tier definitions; a plain internal user cannot; and the
+        system admin implies the manager group for back-compat."""
+        manager = new_test_user(
+            self.env,
+            name="Tier Manager",
+            login="tier_manager",
+            groups="base.group_user,base_tier_validation.group_tier_validation_manager",
+        )
+        plain = new_test_user(
+            self.env, name="Plain", login="plain_user", groups="base.group_user"
+        )
+        vals = {
+            "model_id": self.tester_model.id,
+            "review_type": "individual",
+            "reviewer_id": self.test_user_1.id,
+            "definition_domain": "[('test_field', '=', 1.0)]",
+        }
+        definition = self.env["tier.definition"].with_user(manager).create(dict(vals))
+        self.assertTrue(definition.id)
+        definition.with_user(manager).write({"sequence": 99})
+        with self.assertRaises(AccessError):
+            self.env["tier.definition"].with_user(plain).create(dict(vals))
+        # Back-compat: system administrators implicitly get the new group.
+        self.assertTrue(
+            self.test_user_1.has_group(
+                "base_tier_validation.group_tier_validation_manager"
+            )
+        )
+
 
 @tagged("at_install")
 class TierTierValidationView(CommonTierValidation):

base_tier_validation/views/tier_definition_view.xml

@@ -160,7 +160,9 @@
     <menuitem
         id="menu_tier_confirmation"
         name="Tier Validations"
-        parent="base.menu_custom"
+        groups="base_tier_validation.group_tier_validation_manager"
+        web_icon="base_tier_validation,static/description/icon.png"
+        sequence="80"
     />
     <menuitem
         id="menu_tier_definition"