Some thoughts (since you asked):

The Domain Filter [(1, '!=', 1)] will always test false and I think you mean [(1,'=',1)]. But that will allow this user group to access private addresses. Is that what you want?

Also, any other users (e.g. purchase, inventory, accounting) will have access to private addresses. Is that what you want?

Hello Chris,

You're right the domain filter should be [(1,'=',1)], on the other hand, why do you say that any other users will have access to private addresses? Now, the domain of the archived rule (res.partner.rule.private.employee) apply on the Sale /User: Own Documents Only group and not on the Intern User group, which is the group from where inherit the lowest level of access (User) for inventory, purchase, etc.

If I'm wrong I will appreciate your comment.

Greetings

Without record rules, users have access to all records (if they have access to the table / model).

When you add a record rule it can restrict access.

In your setup, most users ((e.g. purchase, inventory, accounting) will not have any record rule to limit their access to contacts, so they will have access to all records, including private addresses.

i do ur answer step by step but dosen't work.

1st : deactive "res.partner.rule.private.employee"

2 : in record rule Create Own contacts By ['|', ('type', '!=', 'private'), ('type', '=', False), ('user_id', '=', user.id)] domain and sale/user : own... group

3 : in record rule Create All contact By [(1,'=',1)] and sale/user :All doc.. group

if u can help me to solve my problem

i need to sale's user couldn't access or see any contact from purchase's user and as purchase's user from sale's user

Your solution seems to work fine, the issue that i got is when trying to create a new sale order i get this message :

The requested operation ("read" on "Users" (res.users)) was rejected because of the following rules:

(Records: False (id=8), User: False (id=8))

Implicitly accessed through 'Users' (res.users).

How can i fix it ?