Missing restriction to account amounts
In standard only account group can access the GL and the moves. We allow anyone to read the accounts and the account types because they are used as referential data like on the party or product category. But the account and account type have also reporting information that comes from the GL and moves like the amount, balance, debit, credit etc. For coherence we should forbid read access to those computed fields to non-accounting users.