diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 0d07a002bd..61f25e7626 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Enforce record rules when reading only non SQL fields (#12428)
 
 Version 6.0.33 - 2023-06-21
 ---------------------------
diff --git a/trytond/trytond/model/modelsql.py b/trytond/trytond/model/modelsql.py
index 2fdb4c5028..9b251288a5 100644
--- a/trytond/trytond/model/modelsql.py
+++ b/trytond/trytond/model/modelsql.py
@@ -768,7 +768,7 @@ class ModelSQL(ModelStorage):
                         Coalesce(table.write_date, table.create_date)
                         ).cast(sql_type).as_('_timestamp'))
 
-        if len(columns):
+        if len(columns) or domain:
             if 'id' not in fields_names:
                 columns.append(table.id.as_('id'))
 
diff --git a/trytond/trytond/tests/test_rule.py b/trytond/trytond/tests/test_rule.py
index c31f5c06ae..20d7956752 100644
--- a/trytond/trytond/tests/test_rule.py
+++ b/trytond/trytond/tests/test_rule.py
@@ -319,6 +319,33 @@ class ModelRuleTestCase(unittest.TestCase):
         with self.assertRaisesRegex(AccessError, "Field different from foo"):
             TestRule.read([test.id], ['field'])
 
+    @with_transaction(context=_context)
+    def test_perm_read_with_rule_no_sql_type_fail(self):
+        "Test read with rule fail and without SQL type"
+        pool = Pool()
+        TestRule = pool.get('test.rule')
+        RuleGroup = pool.get('ir.rule.group')
+        Model = pool.get('ir.model')
+
+        model, = Model.search([('model', '=', 'test.rule')])
+        rule_group, = RuleGroup.create([{
+                    'name': "Field different from foo",
+                    'model': model.id,
+                    'global_p': True,
+                    'perm_read': True,
+                    'perm_create': False,
+                    'perm_write': False,
+                    'perm_delete': False,
+                    'rules': [('create', [{
+                                    'domain': json.dumps(
+                                        [('field', '!=', 'foo')]),
+                                    }])],
+                    }])
+        test, = TestRule.create([{'field': 'foo'}])
+
+        with self.assertRaisesRegex(AccessError, "Field different from foo"):
+            TestRule.read([test.id], ['rec_name'])
+
     @with_transaction(context=_context)
     def test_search_without_rule(self):
         "Test search without rule"