Composable roles, scopes, approvals, Segregation of Duties and access recertification - one governance layer over native Odoo security.