odoo-securitylisted

Authoring or debugging Odoo access control — ACL (ir.model.access.csv), record rules (ir.rule), groups (res.groups + implied_ids), field-level groups, sudo(), with_user / with_company, and multi-company row isolation. Use whenever a change "works for admin but fails for a normal user", an AccessError or "you are not allowed to" appears, a new model needs permissions, you're about to reach for sudo(), or you'd otherwise GUESS which groups grant what or why a user sees too many / too few rows. Effective access is composed at runtime from every installed addon — read the real ACL + rule dossier first, never guess. Targets Odoo 17/18/19.
tuanle96/odoo-ai-skills · ★ 4 · AI & Automation · score 62

Install: claude install-skill tuanle96/odoo-ai-skills

# Odoo security Effective access on a model is **composed at runtime** from every installed addon: ACL lines union across the user's groups, and record rules from many modules AND/OR together. Neither the source tree nor your memory tells you the effective permission for *this* instance — only the running registry does. Guessing is why "I added a group and it still 403s" and "admin works, user doesn't" keep happening. **Read the real dossier first.** Delegate discovery to the **`odoo-introspect`** skill — `model_brief` dumps the model's ACL + record rules straight from the DB: ```bash odoo-ai --db <DB> brief <model> # security{} = access_rights (ACL) + record_rules odoo-ai --db <DB> all <model> # + entrypoints / metadata / trace odoo-ai --db <DB> security <model> --user <login|id> [--company <id|name>] [--allowed-companies <a,b>] # EFFECTIVE access for one user ``` Inspect `security.access_rights` (the ACL union) and `security.record_rules` (global vs group, `domain_force`, `perm_*`) before changing anything. When the question is "what can **this specific user** actually do / see" (the classic *admin OK, user 403s*), run **`security`**: it combines the ACL additively and resolves the record-rule `effective_domain` with Odoo's own combiner under `with_user`, lists the group-restricted fields, and cross-checks against `check_access`. **Version floor: Odoo 17/18, through Odoo 19 (current LTS).** ACL/record-rule *semantics* are stable back to v14, but group extern