I need to define ir.rule that limits the permissions read, create, write, unlink based on state for a specific security group. If I understand correctly the domain_force filters the records.

<record id="tabla_sp_access_rule" model="ir.rule">
	<field name="name">Access ule</field>
	<field name="model_id" ref="tabla_price.tabla_price_group"/>
	<field name="domain_force">[('create_uid','=',user.id)]</field>
	<field name="groups" eval="[(4, ref('tabla_price.tabla_price_group'))]"/>
</record>
<record id="tabla_sp_state_rule" model="ir.rule">
	<field name="name">States rule</field>
	<field name="model_id" ref="tabla_price.tabla_price"/>
	<field name="domain_force">[('state','in', ['done', 'confirmed', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla_price.tabla_price_group'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>

Because of the domain force now only the records that are from the user and in states will be shown to the user. I need to show user his records and only prevent write and unlink permissions on state.

I cannot just set fields readonly based on states, because different user groups can do different things based on state.

What is the correct way to do this? Can I do this with ir.rules and I just don't undestand domain_force parameter? 

EDIT:

I've got 3 groups: Importer <- Validator <- Admin.

Importer can CRUD only his own records when the state is "draft", other states he can only Read them.

Validator can Read all records but he can only Update them when they are in state "update".

Admin can see all records and use CRUDE for states "draft", "update" and "cancel".

All have model rights 1,1,1,1.

Importer
<record id="tabla_sp_importer_access_rule" model="ir.rule">
	<field name="name">Importer Access Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">['|', ('create_uid','=',user.id), ('partner_id', '=', user.partner_id.id)]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_importer'))]"/>
</record>

<record id="tabla_sp_importer_state_rule" model="ir.rule">
	<field name="name">Importer States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','in', ['done', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_importer'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>


Validator
<record id="tabla_sp_validator_access_rule" model="ir.rule">
	<field name="name">Validator Access Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[(1, '=', 1)]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_validator'))]"/>
</record>

<record id="tabla_sp_validator_state_rule" model="ir.rule">
	<field name="name">Validator States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','in', ['draft', 'done', 'canceled'])]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_validator'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>

Admin
<record id="admin_state_rule" model="ir.rule">
	<field name="name">Administrator States Rule</field>
	<field name="model_id" ref="model_tabla"/>
	<field name="domain_force">[('state','=', 'done')]</field>
	<field name="groups" eval="[(4, ref('tabla.tabla_sp_admin'))]"/>
	<field name="perm_unlink" eval="0"/>
	<field name="perm_write" eval="0"/>
	<field name="perm_read" eval="1"/>
	<field name="perm_create" eval="0"/>
</record>