website_blog/security/website_blog.xml

<?xml version="1.0" encoding="utf-8"?>
<openerp>
    <data>

        <record model="ir.rule" id="website_blog_post_public">
            <field name="name">Blog Post: public: published only</field>
            <field name="model_id" ref="model_blog_post"/>
            <field name="domain_force">[('website_published', '=', True)]</field>
            <field name="groups" eval="[(4, ref('base.group_public')), (4, ref('base.group_portal'))]"/>
        </record>

    </data>
</openerp>