Odoo access rights rely on 3 layers: access groups, model-level rights (ACL) and record rules.
Groups define the role; ACLs set read, write, create and delete per model; record rules filter which records are visible.
Properly configured, they protect sensitive data without slowing daily work.
Golden rule: apply least privilege and test with a non-admin account.
Odoo is a powerful and flexible enterprise management software that offers a range of features to support business operations. One of the key aspects of Odoo is its security system, which enables you to control access to various parts of the system based on the roles and permissions of individual users.
Access rights in Odoo refer to the permissions that control what a user can and cannot do in the system. With access rights, you can set up different levels of access for different users or groups of users, ensuring that sensitive information and critical business processes are protected from unauthorised access.
In this article, we'll take a closer look at the access rights system in Odoo, including how to manage user roles, set up access rules, and create custom access groups.
The 3 levels of access control in Odoo
| Level | What it controls | Example |
|---|---|---|
| Access groups | The role and the features or menus a user can reach | « Sales / Administrator » |
| Model access rights (ACL) | Allowed operations per model: read, write, create, delete | Read orders without being able to delete them |
| Record rules | Which specific records are visible or editable, via a domain | See only your own opportunities |
User Roles in Odoo
In Odoo, user roles are used to define the set of permissions that a user has in the system. There are several built-in user roles in Odoo, including:
- Administrator: this role has full access to all parts of the system, including the ability to manage users, install and uninstall modules, and configure system settings.
- Employee: this role has limited access to the system, primarily to view and edit their own personal information and timesheets.
- Manager: this role has access to most parts of the system, including the ability to manage sales, purchases, and inventory.
You can also create custom user roles in Odoo to define specific sets of permissions for different groups of users.
Access Rules in Odoo
Access rules in Odoo are used to control access to specific records in the system, such as customers, products, and orders. Access rules are defined by creating a domain that specifies the conditions under which a user should be granted access to a particular record.
For example, you might create an access rule that grants access to all customer records for users in the sales team, but restricts access to customer records for users in other teams.
Custom Access Groups in Odoo
In addition to user roles and access rules, Odoo also allows you to create custom access groups. Access groups are used to define sets of permissions that can be assigned to multiple user roles and access rules, making it easier to manage access rights for large groups of users.
You can then assign the access group to multiple user roles and access rules, ensuring that the same set of permissions is applied consistently across the system.
In conclusion, managing access rights in Odoo is an essential part of ensuring the security and integrity of your business data. By setting up user roles, access rules, and custom access groups, you can control access to sensitive information and critical business processes, while ensuring that your users have the access they need to perform their jobs effectively.
With these tools at your disposal, you can customise the access rights in Odoo to meet the specific needs of your organisation and keep your data safe and secure.
Frequently asked questions
What are access rights in Odoo?
They determine what each user can see and do, by combining 3 layers: access groups (the role), model-level rights (read, write, create, delete) and record rules (which specific records are visible).
What's the difference between access groups and record rules?
An access group defines a role and the features a user can reach (e.g. « Sales / User »). A record rule filters, within a module, which records a user can see — for example only their own opportunities, via a domain.
How do I give a user access to a module?
In Settings ▸ Users, open the user's form and assign the access group matching the module (e.g. « Accounting / Accountant »). Developer mode lets you fine-tune model-level rights.
Can a user see only their own data?
Yes, thanks to record rules: a domain restricts access to records linked to the user (« only my opportunities »).
How do I test and secure access rights?
Apply least privilege, then test with a non-admin account (or « Log in as »). A regular audit prevents overly broad access that exposes your data.
