In odoo 11, I assigned a specific group to a window action but I can still access the action even though user does not belong to the group. Can somebody tell me why this does not work? I'm perfectly aware about model and record access rules.

I have this scenario: User A has access to Sales module and no access to Inventory module. However, when user A makes a sale and see the stock picking for the sale, then presses the the refresh button in the browser, then user A can see all stock pickings for all the company. I can restrict with record rules but what I want to restrict is either the window action or the view. In developer mode I can set the group for both the window action and the view but it does NOT work. Am I missing something? I know this was asked before but nobody answered so far. Please somebody who can bring light to this? Why would odoo provide groups restriction to window actions if it does not work? It doesn't make sense. Thanks.