The access rules for wizards doesn't works in Odoo 11
in Odoo, ACLs only apply to regular models and don't need to be defined for Abstract or Transient models, if defined, these will be disregarded and a warning message will be triggered into the server log.
I define access rules, that don't permit read. But it remained readable! So object-level permissions don't work for Transient Model?