Odoo Access Rights: Who Should See What, and How to Keep It That Way

Access in Odoo tends to grow by accident. A new hire gets the same rights as the person next to them, a manager asks for Settings access to fix one thing, an integration runs as an administrator because it was quicker. Two years later, nobody can say for certain who can approve a payment or export the customer list.

Odoo access rights are built to prevent exactly that, as long as you set them up deliberately and check them regularly. This guide explains how users, groups, record rules and companies fit together in Odoo 19, how to build separation of duties on Odoo Enterprise and Community, and a quarterly review that keeps access tidy.

How Odoo Access Rights Work: Users, Roles and Groups

Everyone who signs in is a user. Internal users work in the back end, portal users such as customers and suppliers see their own documents through the portal, and public users are website visitors. In Odoo 19, each internal user also has a Role on the Access Rights tab, User or Administrator, and Administrator places them in the Settings group that controls configuration for the whole database.

The detailed permissions come from groups. On a user's Access Rights tab, each app offers a drop-down of levels, commonly User: Own Documents, User: All Documents and Administrator. Each choice puts the user in a group, and groups can imply others: a Sales administrator, for example, automatically receives the Canned Responses administrator permissions. In developer mode, the Technical Access Rights tab shows the groups you selected and the ones added automatically.

Two rules explain most surprises. Access rights are additive, so a user's permissions are the union of everything their groups grant, and one generous group can undo careful design elsewhere. Access rights also work at model level, granting read, write, create or delete on a whole type of record, such as all invoices or all contacts.

Odoo's documentation warns that careless changes can leave a database where nobody is able to change access rights any more. Make changes on a neutralized copy first, keep two named administrators, and treat superuser mode as an emergency tool.

Record Rules: Which Records Each Group Can Reach

Record rules narrow access down to individual records. A rule is a domain, a filter such as "the salesperson is the current user", applied to read, write, create or delete. That is how a salesperson sees only their own leads while a sales manager sees the whole team's.

• Group rules apply to members of a group and add up: if two apply, satisfying either one is enough.
• Global rules apply to everyone and intersect: each one restricts access further, and two that do not overlap can remove access entirely.
• No rule means no filter. Record rules are default-allow, so if a group can read a model and no rule applies, it reads every record.

Odoo ships a library of record rules for its apps, and its documentation advises anyone unfamiliar with domains to get help before changing them. Keep changes to standard rules rare, put them in a custom module rather than editing them by hand, test them with real user accounts and write down why each one exists.

Multi-Company Access

In a multi-company database, two fields on the user decide where someone can work: Companies, the entities they may access, and Default Company, the one selected when they sign in. Users switch with the company selector at the top of the screen, and can tick several companies to work across them.

Records then follow their Company field. Quotations, invoices and vendor bills belong to one company and appear only when it is active. Products and contacts, on the other hand, are shared across companies by default unless you set a company on them. Decide early which master data is shared, because a shared contact or product is visible to users of every company.

Odoo's documentation warns that misconfigured multi-company access leads to inconsistent behavior. Test with a real user from each company before go-live, not with an administrator who can see everything.