Odoo Security and Access Rights: Complete Setup Guide 2026

What Is Odoo Security and Why It Matters

Odoo security controls who can see, create, edit, and delete data in your system. Without proper security configuration, users may access sensitive information they shouldn't see or accidentally modify critical records.

Proper security setup prevents:

• Sales reps viewing competitor pricing or cost margins
• Warehouse staff modifying financial records
• Junior users deleting important customer data
• Cross-department visibility of confidential information

This guide covers the three pillars of Odoo security: access rights (what you can do), groups (how you organize users), and record rules (which records you can see).

Understanding Odoo's Security Model

Odoo uses a layered security approach with four components working together:

1. Users

Each person gets a user account with an email address. Users belong to groups and inherit their permissions.

2. Groups

Groups define collections of access rights. Users in a group get all its permissions. Groups can inherit from other groups (e.g., Manager inherits from User).

3. Access Rights (ACL)

Access Control Lists define CRUD permissions (Create, Read, Update, Delete) on each model. For example, "Sales User can read and create quotations but not delete them."

4. Record Rules

Record rules filter which specific records a user can access. For example, "Sales reps see only their own quotations" even if they have read access to all quotations.

Configuring Access Rights

Access rights are defined per model in CSV files or through the interface. Each row specifies permissions for a group on a specific model.

Access Rights CSV Format

Odoo stores access rights in ir.model.access.csv files with these columns:

Example: Sales Order Access

id,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
access_sale_order_user,model_sale_order,sales_team.group_sale_salesman,1,1,1,0
access_sale_order_manager,model_sale_order,sales_team.group_sale_manager,1,1,1,1

This configuration allows sales users to read, write, and create orders but not delete them. Managers have full permissions including deletion.

Viewing Access Rights in the Interface

Navigate to Settings > Users & Companies > Groups to see all groups and their permissions. Enable Developer Mode to access detailed configuration.

Creating and Managing Security Groups

Groups organize users by role and define their baseline permissions. Odoo comes with predefined groups for each application.

Default Sales Groups

• Sales User: Own Documents Only - Can see and edit only their own quotations and orders
• Sales User: All Documents - Can see and edit all quotations and orders
• Sales Manager - Full access plus configuration and team management

Creating a Custom Group

Example: Create a "Junior Sales Rep" group with limited permissions:

1. Enable Developer Mode (Settings > scroll down > Activate Developer Mode)
2. Go to Settings > Users & Companies > Groups
3. Click Create
4. Name: "Junior Sales Rep"
5. Application: Select "Sales"
6. Inherited Groups: Add "Sales User: Own Documents Only"
7. Save

Group Inheritance

Groups can inherit from other groups, accumulating permissions. This creates a hierarchy:

• Internal User (base level) → Sales User → Sales Manager
• Each level adds more permissions
• Users can belong to multiple groups (permissions combine)

Implementing Record Rules

Record rules filter which specific records users can access, even if they have model-level read permissions.

When to Use Record Rules

Use record rules when you need to restrict access based on:

• Ownership - Users see only records they created
• Team membership - Users see records for their sales team
• Company - Multi-company setups restrict data per company
• Document state - Draft documents visible only to authors

Record Rule Domain Syntax

Record rules use Odoo domain expressions (Python-like tuples):

# User sees only their own records
[('user_id', '=', user.id)]

# User sees records from their sales team
[('team_id', '=', user.sale_team_id.id)]

# User sees records from their company
[('company_id', 'in', company_ids)]

# User sees draft records they own OR all confirmed records
['|', ('state', '=', 'draft'), ('user_id', '=', user.id), ('state', 'in', ['sale', 'done'])]

Creating a Record Rule

Example: Restrict sales reps to their own quotations:

1. Go to Settings > Technical > Security > Record Rules
2. Click Create
3. Name: "Sales User: Own Quotations Only"
4. Model: "Quotation / Order" (sale.order)
5. Apply for Read: ✓
6. Apply for Write: ✓
7. Apply for Create: ✓
8. Apply for Delete: ✗
9. Groups: Add "Sales User: Own Documents Only"
10. Domain: [('user_id', '=', user.id)]
11. Save

Testing Record Rules

Always test record rules with different user accounts:

1. Create a test user in the target group
2. Log in as that user (or use "Log in as" in Developer Mode)
3. Verify they see only expected records
4. Try accessing a restricted record directly via URL

Multi-Company Security

Odoo's multi-company feature adds another security layer. Users can be assigned to one or multiple companies.

Company Assignment

• Allowed Companies - Companies the user can access
• Current Company - The company the user is working in (switchable)

Company-Based Record Rules

Most Odoo models include a company_id field. Default record rules restrict access:

# Default multi-company rule
['|', ('company_id', '=', False), ('company_id', 'in', company_ids)]

This allows users to see:

• Records with no company set (shared across all companies)
• Records from their assigned companies

Best Practices for Multi-Company

• Assign users only to companies they need
• Use company-specific groups when permissions differ by company
• Test cross-company access thoroughly
• Be careful with shared data (products, customers) - set company to blank if truly shared

Security Audit and Troubleshooting

Checking User Permissions

In Developer Mode, go to any record and click the bug icon > "View Metadata" to see access information:

• Which groups the current user belongs to
• Whether they have read/write/create/delete access
• Which record rules apply

Common Security Issues

Issue: User Can't See Expected Records

Diagnosis:

1. Check user's groups (Settings > Users > select user)
2. Check access rights for the model (Settings > Technical > Security > Access Rights)
3. Check record rules (Settings > Technical > Security > Record Rules)
4. Verify company assignment matches record's company

Issue: User Can See Records They Shouldn't

Diagnosis:

1. Check if user belongs to multiple groups (permissions combine)
2. Look for overly permissive record rules (domain always evaluates to True)
3. Check for manager-level groups that override restrictions

Issue: Access Error When Creating Records

Diagnosis:

1. Check perm_create in access rights CSV
2. Verify record rule allows creation (domain must be satisfiable)
3. Check if required fields are hidden by view-level restrictions

Security Best Practices

Principle of Least Privilege

Start with minimal permissions and add only what's needed:

1. Assign users to the most restrictive group that allows them to work
2. Use "Own Documents Only" groups for junior staff
3. Reserve "All Documents" and Manager groups for supervisors
4. Review permissions quarterly

Regular Security Audits

Schedule quarterly reviews:

• List all users and their groups
• Identify inactive users (disable or archive)
• Review custom record rules for conflicts
• Test critical restrictions with test accounts

Developer Mode Caution

Developer Mode bypasses some restrictions. Never leave it enabled for regular users:

• Enable only when troubleshooting
• Disable immediately after use
• Never grant administrator access to regular users

Conclusion

Odoo security requires understanding four components: users, groups, access rights, and record rules. Proper configuration protects sensitive data while enabling users to work efficiently.

Key takeaways:

• Access rights control CRUD operations on models
• Groups organize users and accumulate permissions through inheritance
• Record rules filter which specific records users can access
• Multi-company adds another layer of data isolation
• Always test security with actual user accounts

Start with Odoo's default groups, customize only when necessary, and audit permissions regularly to maintain a secure system.

Frequently Asked Questions

References

1. Odoo Documentation: "Security" (2026). https://www.odoo.com/documentation/18.0/developer/reference/backend/security.html
2. Odoo Documentation: "Groups and Access Rights" (2026). https://www.odoo.com/documentation/18.0/applications/general/users/access_rights.html
3. Odoo Documentation: "Record Rules" (2026). https://www.odoo.com/documentation/18.0/developer/reference/backend/orm.html
4. Odoo Community Association: "Security Best Practices" (2025). https://github.com/OCA/odoo-community.org
5. Cybrosys Technologies: "Odoo Access Rights and Record Rules Explained" (2025). https://www.cybrosys.com/blog/odoo-access-rights-and-record-rules