In a business application such as Odoo, one of the first questions to consider is who can access the data. Odoo provides a security mechanism to allow access to the data for specific groups of users.

1. Security in Odoo 17
Enterprise

2. Introduction
Enterprise
In a business application such as Odoo, one of the first
questions to consider is who can access the data. Odoo
provides a security mechanism to allow access to the data for
specific groups of users.
Aside from manually managing access using custom code,
Odoo provides two main data-driven mechanisms to manage
or restrict access to data.

3. Enterprise
Access rights
● Create: values for that object can be created by the user.
● Read: the values of that object can be only seen by the
user.
● Update: the values of that object can be edited by the
user.
● Delete: the values of that object can be deleted by the
user.

4. Enterprise
● The user is the only person who is allowed to access the
database.
● We can create many users for a single database. They
are identified with their own login and credentials.
● A user has no access privileges by default. It should be
noted that not all firm personnel are necessarily Odoo
users; rather, an Odoo user is someone who utilizes the
program

5. Enterprise
● Odoo provides two primary data-driven strategies for
controlling or restricting data access, in addition to using
custom code to accomplish so.
● A user can belong to as many groups as they want, and
security mechanisms are associated with groups;
therefore, security mechanisms are applied to users.
● Let’s assume a case that, we are going to create a
custom model.
● So for giving access to users in this model, we need to
add the security directory in the corresponding module.
And add the ir.model.access.csv file to that.

6. Enterprise
Consider the below example
id,name,model_id/id,group_id/id,perm_read,perm_write,perm_create,perm_unlink
access_test_model, access_test_model, model_test_model, base.group_user,1,0,0,0

7. Enterprise
● ‘id’ is indicating the external identifier.
● ‘name’ is the name of ir.access.model
● model_id/id refers to the model to which the access right
applies. The standard way to refer to the model is
model_<model_name>, where <model_name> is the
_name of the model with the ‘.’ replaced by _.
● group_id/id refers to the group to which the access right
applies to.
● perm_read,perm_write,perm_create,perm_unlink: read,
write, create and unlink permissions

8. Enterprise
Finally, need to add this ir.model.access.csv file to the
__manifest__.py file.
'data': [
'security/ir.model.access.csv',
],

9. For More Info.
Check our company website for related
blogs and Odoo book.
Check our YouTube channel for
functional and technical videos in Odoo.
Enterprise
www.cybrosys.com