diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index 6497600468..f6ddf78d7b 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Enforce record rules when reading only non SQL fields (#12428)
 * Support PYSON comparison of timedelta
 * Support encoding timedelta into PYSON TimeDelta
 * Allow date formating in sequences substitutions
diff --git a/trytond/trytond/model/modelsql.py b/trytond/trytond/model/modelsql.py
index c8579f54a8..0d524becdf 100644
--- a/trytond/trytond/model/modelsql.py
+++ b/trytond/trytond/model/modelsql.py
@@ -1059,7 +1059,7 @@ class ModelSQL(ModelStorage):
                 and columns.keys() == {'write_date'}):
             columns.pop('write_date')
             extra_fields.discard('write_date')
-        if columns:
+        if columns or domain:
             if 'id' not in fields_names:
                 columns['id'] = table.id.as_('id')
 
diff --git a/trytond/trytond/tests/test_rule.py b/trytond/trytond/tests/test_rule.py
index a44633d273..d407254d61 100644
--- a/trytond/trytond/tests/test_rule.py
+++ b/trytond/trytond/tests/test_rule.py
@@ -319,6 +319,33 @@ class ModelRuleTestCase(unittest.TestCase):
         with self.assertRaisesRegex(AccessError, "Field different from foo"):
             TestRule.read([test.id], ['field'])
 
+    @with_transaction(context=_context)
+    def test_perm_read_with_rule_no_sql_type_fail(self):
+        "Test read with rule fail and without SQL type"
+        pool = Pool()
+        TestRule = pool.get('test.rule')
+        RuleGroup = pool.get('ir.rule.group')
+        Model = pool.get('ir.model')
+
+        model, = Model.search([('model', '=', 'test.rule')])
+        rule_group, = RuleGroup.create([{
+                    'name': "Field different from foo",
+                    'model': model.id,
+                    'global_p': True,
+                    'perm_read': True,
+                    'perm_create': False,
+                    'perm_write': False,
+                    'perm_delete': False,
+                    'rules': [('create', [{
+                                    'domain': json.dumps(
+                                        [('field', '!=', 'foo')]),
+                                    }])],
+                    }])
+        test, = TestRule.create([{'field': 'foo'}])
+
+        with self.assertRaisesRegex(AccessError, "Field different from foo"):
+            TestRule.read([test.id], ['rec_name'])
+
     @with_transaction(context=_context)
     def test_search_without_rule(self):
         "Test search without rule"