Filter by value or show all if no value
I'd recommend reading Erland Sommarskog's "Dynamic Search Conditions" post here

In your case, here's a fiddle with the pattern:
SQL Fiddle

For posterity, here's the code:

SELECT * 
FROM records r
WHERE 
EXISTS (
  SELECT 1 
  FROM access_rights a
  WHERE r.[function] = a.[function]
  and a.[user] = 'user'
  AND (A.[object] = r.[object] or a.[object] = ''))


Also, please stop using reserved words as column names.