Agent skill · security · sickn33
odoo-security-rules
Expert in Odoo access control: ir.model.access.csv, record rules (ir.rule), groups, and multi-company security patterns.
Why this skill is useful
Provides specific domain knowledge on Odoo security rules, including access control configurations and best practices that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Odoo Security Rules Overview Security in Odoo is managed at two levels: model-level access (who can read/write which models) and record-level rules (which records a user can see). This skill helps you write correct ir.model.access.csv entries and ir.rule domain-based record rules. When to Use This Skill Setting up access rights for a new custom module. Restricting records so users only see their own data or their company's data. Debugging "Access Denied" or "You are not allowed to access" errors. Implementing multi-company record visibility rules. How It Works 1. Activate: Mention @odoo-security-rules and describe the access scenario. 2. Generate: Get correct CSV access lines and XML record rules. 3. Debug: Paste an access error and get a diagnosis with the fix. Examples Example 1: ir.model.access.csv Note: Use base.grouperpmanager for ERP managers, not base.groupsystem — that group is reserved for Odoo's technical superusers. Always create a custom group for module-specific manager roles: Example 2: Record Rule — Users See Only Their Own Records Important: If you omit <field name="groups">, the rule becomes global and applies to ALL users, including admins. Always assign a group unless you explicitly intend a global restriction. Example 3: Multi-Company Record Rule Best Practices ✅ Do: Start with the most restrictive access and open up as needed. ✅ Do: Use companyids (plural) in multi-company rules — it includes all companies the user belongs to. ✅ Do: Test rules using a non-admin user in debug mode — sudo() bypasses all record rules entirely. ✅ Do: Create dedicated security groups per module rather than reusing core Odoo groups. ❌ Don't: Give permunlink = 1 to regular users unless deletion is explicitly required by the business process. ❌ Don't: Leave groupid blank in ir.model.access.csv unless you intend to grant public (unauthenticated) access. ❌ Don't: Use base.groupsystem for module managers — that grants full technical access including server configurations. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/odoo-security-rules