fleet_car_workshop/security/workshop_security.xml

<?xml version="1.0" ?>
<openerp>
    <data noupdate="0">

        <record id="fleet_car_workshop.main_workshop_menu" model="ir.ui.menu">
           <field name="groups_id" eval="[(6, 0, [ref('fleet.group_fleet_user')] )]"/>
        </record>
        <record id="fleet_car_workshop.workshop_vehicles" model="ir.ui.menu">
           <field name="groups_id" eval="[(6, 0, [ref('fleet.group_fleet_user')] )]"/>
        </record>
        <record id="fleet_car_workshop.vehicle_works" model="ir.ui.menu">
           <field name="groups_id" eval="[(6, 0, [ref('fleet.group_fleet_user')] )]"/>
        </record>
          <record id="fleet_car_workshop.menu_worksheet_config" model="ir.ui.menu">
           <field name="groups_id" eval="[(6, 0, [ref('fleet.group_fleet_manager')] )]"/>
        </record>
         <record id="fleet_car_workshop.menu_worksheet_stages_action" model="ir.ui.menu">
           <field name="groups_id" eval="[(6, 0, [ref('fleet.group_fleet_manager')] )]"/>
        </record>
        <record id="fleet_user_vehicle_visibility_user" model="ir.rule">
            <field name="name">Manager has all rights on vehicle</field>
            <field name="model_id" ref="fleet.model_fleet_vehicle"/>
            <field name="groups" eval="[(4, ref('fleet.group_fleet_user'))]"/>
        </record>

    </data>
</openerp>