timesheet_works relies on record rules
The timesheet_works entry point relies on the record rules to return only the work linked to the employee company. But it is not the case of all users, for example admin group users does not have this rule. This means that application like chronos can try to create timesheet line for which the work value will be not valid for its domain.
I think we should ensure to return only company work by using a domain.