<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <!-- placeholder for future record rules (e.g. restricting who can see
         xeno.leave.approver rows); none needed yet, config is HR-officer
         only per ir.model.access.csv -->

    <!-- hr_holidays ships base.group_user with full create rights on
         hr.leave.allocation (access_hr_holidays_employee_allocation),
         which is what puts a working "New" button on every employee's own
         native "My Leave Balance" list, allocations are meant to be
         HR-granted, not self-requested, so creation is switched off here
         for that one access row only (read/write/unlink untouched, and
         HR's own access_hr_holidays_user_allocation row is separate and
         keeps full rights). Removing perm_create also makes Odoo's web
         client drop the "New" button itself, everywhere, with no separate
         view-level change needed. -->
    <record id="hr_holidays.access_hr_holidays_employee_allocation" model="ir.model.access">
        <field name="perm_create">0</field>
    </record>
</odoo>
