Access Rights Management
One screen to decide who sees what / profiles, record rules, login security, device control and a full audit trail.
Odoo 17 Community & Enterprise LGPL-3Access Profiles
Hide menus, lock model buttons, restrict fields, enforce record-level rules, hide chatter & search filters / all from one profile.
Login Security
Allowed IPs, working hours, device whitelist, 2FA enforcement policies applied live, not at next login.
Full Audit Trail
Login attempts, permission changes, sensitive data access and every CSV/Excel export / with exact columns.
Getting Started / App & Dashboard
Everything lives under one app called Access Rights. Start from the dashboard to see your current posture, then move to profiles.
All module screens live under a single app called Access Rights in the top navigation bar.
Quick glance: covered users, active rules, login activity, denied reasons and profile coverage percentage.
Actionable risks: uncovered users, inactive accounts, admin count, blocked devices and large sensitive exports.
One row per profile: department, assigned users, rule count and validity period at a glance.
Building an Access Profile
A profile is the building block: define who is affected, then configure what gets restricted.
Pick a whole department or individual users, and choose which companies the restrictions apply to.
Profile-wide switches (read-only, no developer mode, disable login) and an optional expiry date for temporary access.
Restriction Tabs The Heart of the Module
Each tab restricts a different layer. Records is the one that truly blocks data; the other tabs clean up the UI and prevent mistakes.
Select menus to hide from the user's view / cosmetic hiding that should be backed by a data-level rule.
Per-model control: lock create/edit/delete/export, hide reports and specific view types.
Hide a field or make it read-only. Hidden fields also disappear from exports, filters and group-by.
ORM-level record rules enforced in the UI and the API. Rules can only restrict / they never widen what the user's groups already allow.
Hide specific buttons, smart buttons and notebook tabs / the system scans the model's views and shows them as a checklist.
Hide predefined filters and group-by options from the search bar for selected models.
Hide the entire chatter or individual buttons (Message / Note / Activity) per model.
Restrict login by IP/network, weekdays and hours. Violations terminate the session immediately / not at next login.
Switches that apply to all models at once instead of configuring them model by model.
Roll Out at Scale
Cover a whole department from a ready-made template, or clone one user's access to new hires / no per-user setup needed.
Start from a safe template and cover an entire department in one click / admins and already-covered users are skipped.
Internal users screen to review their permissions and link them to access profiles.
Clone groups and profiles from one user to others: add on top of existing access or full replacement.
ð Audit & Security
Answer every compliance question: Who logged in? From where? Who accessed sensitive data? Who exported a file?
Every login attempt: success, wrong password, or denied (IP / hours / device / disabled login) / with full device and browser details.
New device, new IP, odd hours, or burst of failed attempts / managers are notified automatically.
Every device a user connects from / name it, trust it, or block it. A blocked device cannot log in even with the correct password.
Tag sensitive fields (salary, cost, credit limit) and see who can read each one right now.
Who granted or revoked what, to whom, and when / admin grants are flagged in red.
Every CSV/Excel download: who, from which screen, and exactly which columns were included.
Departments are the coverage foundation: a profile linked to a department automatically follows its employees.
Built for Performance
Profiled users get their own view-cache key instead of the global cache flush-on-every-page-load that similar apps do. Every rule lookup is ORM-cached, so the module adds negligible overhead to page loads.
Full Feature List
| Category | Feature |
|---|---|
| Profiles | Hide menus & sub-menus |
| Lock create / edit / delete / duplicate / archive / import / export per model | |
| Fields: invisible, read-only, required, no external link | |
| ORM-level record rules with domain filters | |
| Hide buttons, smart buttons, notebook tabs | |
| Hide search filters & group-by options | |
| Hide chatter or individual chatter buttons per model | |
| Validity period for temporary access (auditors, holiday cover) | |
| Deployment | Roll Out Profiles / cover a department in one click |
| Copy User Access / clone groups & profiles to other users | |
| Login Security | Allowed IPs / networks, weekdays & hours per timezone |
| 2FA enforcement, device whitelist / blocklist | |
| Live enforcement / takes effect on next request, not next login | |
| Audit | Login Audit / every attempt with device, IP, browser, OS |
| Unusual Logins / anomaly detection with manager notifications | |
| Permission Changes / who granted/revoked what, to whom, when | |
| Sensitive Data / tag fields & see who can read them | |
| Export Audit / every download with exact columns & source screen |
Need Help?
For support, feature requests or custom development please use the Support tab on this app's page or contact us directly.
Please log in to comment on this module