diff --git a/addons/laundry_management/security/res_groups.xml b/addons/laundry_management/security/res_groups.xml
new file mode 100644
index 0000000..c719f9c
--- /dev/null
+++ b/addons/laundry_management/security/res_groups.xml
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         LAUNDRY PERMISSION GROUPS  (Odoo 19 — privilege-based)
+         The privilege groups all our res.groups under a single
+         "Laundry" section on the user form (Settings → Users).
+    ══════════════════════════════════════════════════════════════ -->
+
+    <record id="module_category_laundry" model="ir.module.category">
+        <field name="name">Laundry</field>
+        <field name="description">Laundry operations and POS settlement permissions.</field>
+        <field name="sequence">30</field>
+    </record>
+
+    <record id="res_groups_privilege_laundry" model="res.groups.privilege">
+        <field name="name">Laundry</field>
+        <field name="sequence">30</field>
+        <field name="category_id" ref="module_category_laundry"/>
+    </record>
+
+    <record id="group_laundry_operator" model="res.groups">
+        <field name="name">Operator</field>
+        <field name="sequence">10</field>
+        <field name="privilege_id" ref="res_groups_privilege_laundry"/>
+        <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="group_laundry_cashier" model="res.groups">
+        <field name="name">Cashier</field>
+        <field name="sequence">20</field>
+        <field name="privilege_id" ref="res_groups_privilege_laundry"/>
+        <field name="implied_ids" eval="[
+            (4, ref('group_laundry_operator')),
+            (4, ref('sales_team.group_sale_salesman')),
+            (4, ref('account.group_account_invoice')),
+        ]"/>
+    </record>
+
+    <!-- Kept for backward compatibility with any prior ir.model.access.csv
+         references to group_laundry_user. Not exposed as a separate row
+         on the user form — it merely chains into Cashier. -->
+    <record id="group_laundry_user" model="res.groups">
+        <field name="name">Laundry / User</field>
+        <field name="implied_ids" eval="[(4, ref('group_laundry_cashier'))]"/>
+    </record>
+
+    <record id="group_laundry_manager" model="res.groups">
+        <field name="name">Manager</field>
+        <field name="sequence">30</field>
+        <field name="privilege_id" ref="res_groups_privilege_laundry"/>
+        <field name="implied_ids" eval="[
+            (4, ref('group_laundry_user')),
+            (4, ref('sales_team.group_sale_manager')),
+            (4, ref('account.group_account_manager')),
+        ]"/>
+    </record>
+
+    <!-- Phase 3 — explicit override privilege.
+         Held in addition to Manager. Required to use the
+         "Unlock for Editing" wizard on a locked laundry.order.
+         Kept narrow so the standard Manager role can still be
+         assigned without granting unlock-the-world rights. -->
+    <record id="group_laundry_manager_override" model="res.groups">
+        <field name="name">Manager Override (Unlock Locked Orders)</field>
+        <field name="sequence">40</field>
+        <field name="privilege_id" ref="res_groups_privilege_laundry"/>
+        <field name="implied_ids" eval="[(4, ref('group_laundry_manager'))]"/>
+    </record>
+
+</odoo>