diff --git a/CHANGELOG b/CHANGELOG
index f676408d5b..c706f370e3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* set_context of Transaction.set_user is restricted to root
 * Add a "copy" action to One2Many and Many2Many's set method
 * Force UTC as timezone (migration script available on tryton-tools)
 * Add relation_field for many2one
diff --git a/trytond/tests/test_transaction.py b/trytond/tests/test_transaction.py
index 6928a98475..3f2e5e40a3 100644
--- a/trytond/tests/test_transaction.py
+++ b/trytond/tests/test_transaction.py
@@ -56,6 +56,41 @@ class TransactionTestCase(unittest.TestCase):
             Exception, manipulate_cursor, DB_NAME, USER, context=CONTEXT)
         self.assertTrue(empty_transaction(DB_NAME, USER, context=CONTEXT))
 
+    def test0030set_user(self):
+        '''
+        Test set_user
+        '''
+        with Transaction().start(DB_NAME, USER, context=CONTEXT) \
+                as transaction:
+            self.assertEqual(transaction.user, USER)
+            self.assertEqual(transaction.context.get('user'), None)
+
+            with Transaction().set_user(0):
+                self.assertEqual(transaction.user, 0)
+                self.assertEqual(transaction.context.get('user'), None)
+
+            with Transaction().set_user(0, set_context=True):
+                self.assertEqual(transaction.user, 0)
+                self.assertEqual(transaction.context.get('user'), USER)
+
+                # Nested same set_user should keep original context user
+                with Transaction().set_user(0, set_context=True):
+                    self.assertEqual(transaction.user, 0)
+                    self.assertEqual(transaction.context.get('user'), USER)
+
+                # Unset user context
+                with Transaction().set_user(0, set_context=False):
+                    self.assertEqual(transaction.user, 0)
+                    self.assertEqual(transaction.context.get('user'), None)
+
+            # set context for non root
+            self.assertRaises(ValueError,
+                Transaction().set_user, 2, set_context=True)
+
+            # not set context for non root
+            with Transaction().set_user(2):
+                self.assertEqual(transaction.user, 2)
+
 
 def suite():
     return unittest.TestLoader().loadTestsFromTestCase(TransactionTestCase)
diff --git a/trytond/transaction.py b/trytond/transaction.py
index 9552b4a57e..5dba87367a 100644
--- a/trytond/transaction.py
+++ b/trytond/transaction.py
@@ -118,10 +118,16 @@ class Transaction(local):
         return manager
 
     def set_user(self, user, set_context=False):
+        if user != 0 and set_context:
+            raise ValueError('set_context only allowed for root')
         manager = _AttributeManager(user=self.user,
-                context=self.context.copy())
+                context=self.context)
+        self.context = self.context.copy()
         if set_context:
-            self.context.update({'user': self.user})
+            if user != self.user:
+                self.context['user'] = self.user
+        else:
+            self.context.pop('user', None)
         self.user = user
         return manager