How can I filter data according user permission?

Hi Andrey,
The XPO library does not support global filters out-of-the-box. You can implement a custom object layer (IObjectLayer) and modify criteria passed in the "queries" argument in LoadObjects, LoadObjectsAsync, SelectData and SelectDataAsync methods.
For example, if all your classes have the CompanyID member and you wish to filter out records by this member value, you can implement an object layer by inheriting from the existing SimpleObjectLayer class and overriding the necessary methods as follows:

C#
static class Program {  
    [STAThread]  
    static void Main() {  

        string connString = DevExpress.Xpo.DB.MSSqlConnectionProvider.GetConnectionString("(local)", "MyDB");  
        XpoDefault.ObjectLayer = new MySimpleObjectLayer(XpoDefault.GetDataLayer(connString, AutoCreateOption.None));  

        ...  
    }  
}  

public class MySimpleObjectLayer : SimpleObjectLayer, IObjectLayer {  
    public MySimpleObjectLayer(IDataLayer dataLayer) : base(dataLayer) { }  

    System.Collections.ICollection[] IObjectLayer.LoadObjects(Session session, ObjectsQuery[] queries) {  
        return base.LoadObjects(session, PatchCriteria(queries));  
    }  

    void IObjectLayer.LoadObjectsAsync(Session session, ObjectsQuery[] queries, DevExpress.Xpo.Helpers.AsyncLoadObjectsCallback callback) {  
        base.LoadObjectsAsync(session, PatchCriteria(queries), callback);  
    }  

    List<object[]> IObjectLayer.SelectData(Session session, ObjectsQuery query, CriteriaOperatorCollection properties, CriteriaOperatorCollection groupProperties, CriteriaOperator groupCriteria) {  
        return base.SelectData(session, PatchCriteria(query), properties, groupProperties, groupCriteria);  
    }  

    void IObjectLayer.SelectDataAsync(Session session, ObjectsQuery query, CriteriaOperatorCollection properties, CriteriaOperatorCollection groupProperties, CriteriaOperator groupCriteria, AsyncSelectDataCallback callback) {  
        base.SelectDataAsync(session, PatchCriteria(query), properties, groupProperties, groupCriteria, callback);  
    }  

    private ObjectsQuery[] PatchCriteria(ObjectsQuery[] queries) {  
        for (int i = 0; i < queries.Length; i++) {  
            queries[i] = PatchCriteria(queries[i]);  
        }  
        return queries;  
    }  

    private ObjectsQuery PatchCriteria(ObjectsQuery query) {  
        query.Criteria = GroupOperator.Combine(GroupOperatorType.And, query.Criteria, new BinaryOperator("CompanyID", "test"));  
        return query;  
    }  
}  

In addition, I suggest that you refer to our source code to learn details of existing IObjectLayer implementations.
See also:
Object Access Layer.