From acc95d8ee047408bcdbf7691808dc1a93dd28cf9 Mon Sep 17 00:00:00 2001
From: gsinghpal <gur_preet.singh@outlook.com>
Date: Sun, 24 May 2026 12:05:14 -0400
Subject: [PATCH] feat(shopfloor-sec): group_fp_tablet_kiosk for tablet kiosk
 session

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../security/fp_tablet_kiosk_security.xml          | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml

diff --git a/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml b/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml
new file mode 100644
index 00000000..88d2fe8f
--- /dev/null
+++ b/fusion_plating/fusion_plating_shopfloor/security/fp_tablet_kiosk_security.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+    <!-- Tablet kiosk group: orthogonal to the Fusion Plating role hierarchy.
+         NO privilege_id (would clutter the role picker). This group holds
+         the bare minimum ACL for the lock screen to render and accept PIN:
+            - read res.users (tile grid)
+            - read ir.config_parameter (idle/ceiling settings)
+         Nothing else. The dedicated fp_tablet_kiosk user is the only
+         expected member. -->
+    <record id="group_fp_tablet_kiosk" model="res.groups">
+        <field name="name">Tablet Kiosk Session</field>
+        <field name="sequence">100</field>
+    </record>
+</odoo>