Two things are not resolved by installing the module and have to be reviewed
by hand.

**The record rules change existing permissions.** Before this module, every
internal user could write and delete the timesheet sheet of any other
employee. The module restricts writing and deleting to the owner of the sheet
for every internal user (``base.group_user``), and lifts the restriction for
the members of *Timesheets / Administrator*
(``hr_timesheet.group_timesheet_manager``), who keep access to every sheet.
The restrictive rule is set on ``base.group_user`` on purpose: a rule set on a
timesheet group would leave any internal user outside that group with the
unrestricted access the ACL grants and no rule at all. Reading is left open so
that the *All Timesheet Sheets* menu and the reports keep working. Check with
the customer whether any flow relies on a colleague editing somebody else's
sheet before installing.

**The time off policy has a conservative default.** In
*Settings / Timesheets / Timesheet Options*, the field *Time Off Policy On
Sheet Deletion* is per company and defaults to *Keep the time off, detach its
lines*: deleting a sheet never touches a time off request nor an employee
balance. An installation that expects the deletion of a sheet to cancel the
time off it contains has to set *Cancel the time off and restore the balance*
on purpose. That value is irreversible and cancels the whole request, even the
days that fall in other weeks.