domains / families / security / odoo-security-rules

odoo-security-rules

authentic

Expert in Odoo access control: ir.model.access.csv, record rules (ir.rule), groups, and multi-company security patterns.

When to use

• Setting up access rights for a new custom module.
• Restricting records so users only see their own data or their company's data.
• Debugging "Access Denied" or "You are not allowed to access" errors.
• Implementing multi-company record visibility rules.

When not to use

• Does not cover **field-level access control** (`ir.model.fields` read/write restrictions) — those require custom OWL or Python overrides.
• **Portal and public user** access rules have additional nuances not fully covered here; test carefully with `base.group_portal`.
• Record rules are **bypassed by `sudo()`** — any code running in superuser context ignores all `ir.rule` entries.
• Does not cover **row-level security via PostgreSQL** (RLS) — Odoo manages all security at the ORM layer.

Skill page

Source