diff --git a/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml b/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml
new file mode 100644
index 00000000..88d2fe8f
--- /dev/null
+++ b/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <!-- Tablet kiosk group: orthogonal to the Fusion Plating role hierarchy.
+         NO privilege_id (would clutter the role picker). This group holds
+         the bare minimum ACL for the lock screen to render and accept PIN:
+            - read res.users (tile grid)
+            - read ir.config_parameter (idle/ceiling settings)
+         Nothing else. The dedicated fp_tablet_kiosk user is the only
+         expected member. -->
+    <record id="group_fp_tablet_kiosk" model="res.groups">
+        <field name="name">Tablet Kiosk Session</field>
+        <field name="sequence">100</field>
+    </record>
+</odoo>