diff --git a/addons/laundry_management/security/ir_rule.xml b/addons/laundry_management/security/ir_rule.xml
new file mode 100644
index 0000000..1eddeaf
--- /dev/null
+++ b/addons/laundry_management/security/ir_rule.xml
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="utf-8"?>
+<odoo>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         RECORD RULES — Laundry Orders (laundry.order)
+
+         Company-restricted access per role.
+         Admin / superuser bypasses all ir.rule by design.
+    ══════════════════════════════════════════════════════════════ -->
+
+    <!-- Operator: read-only access to laundry orders in own company -->
+    <record id="rule_laundry_order_operator" model="ir.rule">
+        <field name="name">Laundry Order: Operator read own company</field>
+        <field name="model_id" ref="model_laundry_order"/>
+        <field name="domain_force">[('company_id', 'in', company_ids)]</field>
+        <field name="groups" eval="[(4, ref('group_laundry_operator'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="False"/>
+        <field name="perm_create" eval="False"/>
+        <field name="perm_unlink" eval="False"/>
+    </record>
+
+    <!-- Cashier: read / write / create (no delete) -->
+    <record id="rule_laundry_order_cashier" model="ir.rule">
+        <field name="name">Laundry Order: Cashier read/write/create own company</field>
+        <field name="model_id" ref="model_laundry_order"/>
+        <field name="domain_force">[('company_id', 'in', company_ids)]</field>
+        <field name="groups" eval="[(4, ref('group_laundry_cashier'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="True"/>
+        <field name="perm_create" eval="True"/>
+        <field name="perm_unlink" eval="False"/>
+    </record>
+
+    <!-- Manager: full CRUD -->
+    <record id="rule_laundry_order_manager" model="ir.rule">
+        <field name="name">Laundry Order: Manager full access own company</field>
+        <field name="model_id" ref="model_laundry_order"/>
+        <field name="domain_force">[('company_id', 'in', company_ids)]</field>
+        <field name="groups" eval="[(4, ref('group_laundry_manager'))]"/>
+        <field name="perm_read" eval="True"/>
+        <field name="perm_write" eval="True"/>
+        <field name="perm_create" eval="True"/>
+        <field name="perm_unlink" eval="True"/>
+    </record>
+
+</odoo>