User Access Review & Recertification
Periodic access recertification campaigns, approve/revoke rights, audit trail
User Access Review & Recertification brings periodic who-has-access-to-what recertification into Odoo without any external Identity/IAM platform. A manager launches a review campaign, every reviewer approves or revokes each access right one by one, and revocations are actually enforced on the user's account, with a full evidence trail of every decision.
Key Features
New Campaign wizard auto-resolves scope
access.review.campaign.wizard reads the CURRENT security groups of every selected user and generates one access.review.item per user x access-right pair automatically, with a configurable exclude list for noise groups like the base Internal User flag.
Campaign dashboard and lifecycle
Each access.review.campaign tracks item count, completion rate, pending/approved/revoked counts and an overdue flag, moving through a Draft, In Progress, Completed, Cancelled workflow enforced by action_start/action_complete/action_cancel/action_reopen.
Approve or revoke with mandatory justification
Each access.review.item is a single user x access-right row decided via action_approve or action_revoke; validate_decision_input requires a justification whenever the decision is Revoke.
Revocation is actually enforced
action_apply removes the res.groups access right from the user's group_ids for real via an unlink command, so a revoke decision genuinely cuts off access, not just a paper record, with a bulk action_apply_revocations from the campaign.
Full audit trail via chatter and activities
Both campaign and item inherit mail.thread/mail.activity.mixin: every decision is tracked, review reminders are scheduled as to-do activities on the reviewer, and applying a revocation posts a chatter note on both the item and the campaign.
Overdue detection and daily reminders
A computed is_overdue field (with a matching search method) flags pending items and campaigns past their deadline, and the _cron_send_deadline_reminders scheduled action posts a chatter summary and nudges the campaign owner once per overdue campaign.
Completion gate on unresolved rights
action_complete blocks closing a campaign until every item has an actual Approve/Revoke decision and every decided revocation has been applied, so no recertification round can finish with unresolved access.
My Reviews personal list
Every reviewer can filter to exactly the access-right items assigned to them as reviewer_id, independent of who else is reviewing the same campaign.
Use Cases
Screenshots
01 Campaign List
02 Campaign Form
03 Review Item List
04 Review Item Form
05 New Campaign Wizard
Why Choose This Module
Unlike a spreadsheet-based access review, every decision here is enforced and auditable inside Odoo itself: revoking a right is a single click that genuinely removes the security group, every approve/revoke carries a timestamp, decider and justification, and a campaign simply cannot be marked complete while any access right is still unresolved.
Specifications
- Compatible: Odoo 18.0 / 19.0
- License: OPL-1
- Languages: 35+
- Author: Pokutsoft
- Dependencies: base, mail
- Support: odoo@gencbaris.com
- Update date: 2026-07-13
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
Discuss (mail)
|
| Lines of code | 928 |
| Technical Name |
user_access_review_recertification |
| License | OPL-1 |
| Website | https://pokutsoft.com/ |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module