diff --git a/runbot_merge/__manifest__.py b/runbot_merge/__manifest__.py
index 9b6a4e73..0f81d5df 100644
--- a/runbot_merge/__manifest__.py
+++ b/runbot_merge/__manifest__.py
@@ -2,6 +2,9 @@
     'name': 'merge bot',
     'depends': ['contacts', 'website'],
     'data': [
+        'security/security.xml',
+        'security/ir.model.access.csv',
+
         'data/merge_cron.xml',
         'views/res_partner.xml',
         'views/mergebot.xml',
diff --git a/runbot_merge/security/ir.model.access.csv b/runbot_merge/security/ir.model.access.csv
new file mode 100644
index 00000000..7618b609
--- /dev/null
+++ b/runbot_merge/security/ir.model.access.csv
@@ -0,0 +1,15 @@
+id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
+access_runbot_merge_project_admin,Admin access to project,model_runbot_merge_project,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_repository_admin,Admin access to repo,model_runbot_merge_repository,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_branch_admin,Admin access to branches,model_runbot_merge_branch,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_pull_requests_admin,Admin access to PR,model_runbot_merge_pull_requests,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_pull_requests_tagging_admin,Admin access to tagging,model_runbot_merge_pull_requests_tagging,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_commit_admin,Admin access to commits,model_runbot_merge_commit,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_stagings_admin,Admin access to stagings,model_runbot_merge_stagings,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_split_admin,Admin access to splits,model_runbot_merge_split,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_batch_admin,Admin access to batches,model_runbot_merge_batch,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_fetch_job_admin,Admin access to fetch jobs,model_runbot_merge_fetch_job,runbot_merge.group_admin,1,1,1,1
+access_runbot_merge_project,User access to project,model_runbot_merge_project,base.group_user,1,0,0,0
+access_runbot_merge_repository,User access to repo,model_runbot_merge_repository,base.group_user,1,0,0,0
+access_runbot_merge_branch,User access to branches,model_runbot_merge_branch,base.group_user,1,0,0,0
+access_runbot_merge_pull_requests,User access to PR,model_runbot_merge_pull_requests,base.group_user,1,0,0,0
diff --git a/runbot_merge/security/security.xml b/runbot_merge/security/security.xml
new file mode 100644
index 00000000..62e1f323
--- /dev/null
+++ b/runbot_merge/security/security.xml
@@ -0,0 +1,8 @@
+<odoo>
+    <record model="res.groups" id="group_admin">
+        <field name="name">Mergebot Administrator</field>
+    </record>
+    <record model="res.groups" id="base.group_system">
+        <field name="implied_ids" eval="[(4, ref('runbot_merge.group_admin'))]"/>
+    </record>
+</odoo>
diff --git a/runbot_merge/tests/remote.py b/runbot_merge/tests/remote.py
index 692e398a..c73ef330 100644
--- a/runbot_merge/tests/remote.py
+++ b/runbot_merge/tests/remote.py
@@ -102,9 +102,12 @@ def wait_for_server(db, timeout=120):
     limit = time.time() + timeout
     while True:
         try:
+            uid = xmlrpc.client.ServerProxy(
+                'http://localhost:{}/xmlrpc/2/common'.format(PORT))\
+                .authenticate(db, 'admin', 'admin', {})
             xmlrpc.client.ServerProxy(
                 'http://localhost:{}/xmlrpc/2/object'.format(PORT)) \
-                .execute_kw(db, 1, 'admin', 'runbot_merge.batch', 'search',
+                .execute_kw(db, uid, 'admin', 'runbot_merge.batch', 'search',
                             [[]], {'limit': 1})
             break
         except ConnectionRefusedError:
@@ -277,12 +280,13 @@ def make_repo(request, config, project, github, tunnel, users, owner):
 
 class Environment:
     def __init__(self, port, db):
+        self._uid = xmlrpc.client.ServerProxy('http://localhost:{}/xmlrpc/2/common'.format(port)).authenticate(db, 'admin', 'admin', {})
         self._object = xmlrpc.client.ServerProxy('http://localhost:{}/xmlrpc/2/object'.format(port))
         self._db = db
 
     def __call__(self, model, method, *args, **kwargs):
         return self._object.execute_kw(
-            self._db, 1, 'admin',
+            self._db, self._uid, 'admin',
             model, method,
             args, kwargs
         )