Odoo access control mistakes that break your workflow

The workflow suddenly stops for certain users

You receive a call from the warehouse team: they can’t confirm shipments in Odoo. The sales team reports that customer records are missing from the CRM view. The accounting team sees only half of the invoices. No error message appears, no crash happens, yet the system feels broken.

This is the classic symptom of an access rights misconfiguration. In Odoo, access rights are permissions that decide who can view, edit, create, or delete records. When these rights are set incorrectly, users lose visibility or control over data they should have, without any obvious crash or log entry.

Common patterns you’ll see:

• Users in Group A can see records created by Group B, but users in Group B cannot see their own records.
• The Sales Manager role can’t edit quotations, but the Sales User role can.
• Warehouse operators see customer data they should never access.

These symptoms point to a single root cause: incorrect or overly restrictive access rights in the Access Rights settings under Settings > Users & Companies > Groups.

Why access rights break silently

Odoo uses a layered security model. At the top are groups—collections of users with similar roles (e.g., Sales, Accounting, Warehouse). Each group is assigned access rights to models (e.g., Sales Order, Invoice, Product). These rights define what actions a user can perform on each model.

When rights are misconfigured, Odoo doesn’t crash. Instead, it returns empty lists, hides buttons, or blocks edits—silently. The problem is compounded because:

• Rights can be set at the group level or overridden at the user level.
• Inheritance can be complex: a group may inherit rights from another group, and overrides may exist in custom modules.
• Record rules (domain filters) can further restrict visibility, but are often confused with access rights.

For non-technical users, the main confusion is between:

• Access rights: Define what actions are allowed (read, write, create, delete) on a model.
• Record rules: Define which records a user can see based on conditions (e.g., only invoices for their own company).

Both must be correct for a user to work normally. If either is wrong, the user sees incomplete or no data.

Quick checks to confirm it’s an access issue

Before diving into settings, perform these quick checks to confirm the issue is access-related and not a bug or data corruption.

Check 1: Log in as the affected user

Ask the user to log in or use Settings > Users & Companies > Users to open the user’s record in admin mode. Switch to the user’s perspective using the Login as User button.

If the user sees different data than the admin, the issue is likely access rights or record rules.

Check 2: Compare user groups

Open the user’s record and check the Groups tab. Compare it to a working user in the same role. Look for:

• Missing groups (e.g., Sales / User is not assigned).
• Unexpected groups (e.g., Accounting / Manager assigned to a warehouse user).
• Custom groups from /odoo-custom-addons.html that may not be properly configured.

Check 3: Test with a superuser

Log in as a superuser (admin). Open the same record the user reported missing. If the admin sees the record, but the user doesn’t, it confirms an access issue.

Check 4: Look for record rule errors

Go to Settings > Technical > Record Rules. Filter for the model in question (e.g., sale.order). If you see rules with Domain conditions that don’t match the user’s access, they may be filtering out necessary records.

How to fix access rights step by step

Fixing access rights is a two-step process: correct the group assignments, then adjust access rights and record rules. Follow these steps in order.

Step 1: Assign correct groups

Navigate to Settings > Users & Companies > Groups. Identify the group that matches the user’s role (e.g., Sales / User).

Open the user’s record under Users, go to the Groups tab, and add or remove groups as needed.

Tip: Use the Apply to: All Users filter to see which users are in each group. This helps avoid missing users with the same issue.

Step 2: Review access rights for the group

Open the group record. Go to the Access Rights tab. For each model, ensure the correct permissions are set:

• Read: Allows viewing records.
• Write: Allows editing records.
• Create: Allows creating new records.
• Unlink: Allows deleting records.

Example: For the Sales / User group, ensure Read and Write are enabled for sale.order, sale.order.line, and product.template. Disable Unlink unless managers need to delete orders.

Note: If you’re using /odoo-custom-addons.html, check the group’s Access Rights tab for models added by custom modules. These may need manual configuration.

Step 3: Adjust record rules if needed

Go to Settings > Technical > Record Rules. Filter for the model in question. Review the rules assigned to the group. Ensure the Domain condition matches the intended access.

Example: A rule for sale.order might have a domain like ['|', ('user_id', '=', uid), ('team_id.user_ids', '=', uid)]. This allows users to see orders assigned to them or their team. If the domain is incorrect, users won’t see the orders they should.

Tip: Record rules are cumulative. If multiple rules apply, Odoo uses the most restrictive one. Simplify rules where possible to avoid conflicts.

Step 4: Test and verify

After making changes, log in as the affected user or use Login as User. Verify that:

• The user can see the expected records.
• Buttons for allowed actions are visible (e.g., Edit, Create).
• Records the user should not see are hidden.

If the issue persists, repeat the checks. Common mistakes include:

• Overriding rights in a custom module without updating the group.
• Forgetting to assign the group to all relevant users.
• Record rules that are too restrictive or conflicting.

Version differences that trip up access control

Odoo updates often change how access rights and record rules work. A configuration that worked in Odoo 13 may break in Odoo 16 or 17. Here’s what to watch for across versions.

Odoo 14 and earlier

• Access rights were simpler but less flexible. Groups had a flat structure.
• Record rules were less strict. Multiple rules could apply without strict enforcement.
• Custom modules often overrode access rights directly in Python code, which could conflict with group settings.

Odoo 15+

• Access rights became more granular. Groups can inherit from multiple parent groups.
• Record rules are stricter. Odoo enforces the most restrictive rule first, which can hide records unexpectedly.
• New security models like Row-Level Security (RLS) were introduced, which may override group-based access in PostgreSQL.

Practical impact: If you upgraded from Odoo 14 to 16 and users suddenly can’t see records, check for new record rules or RLS settings in Settings > Technical > Security Rules.

Migration tip: Before upgrading, review your Access Rights and Record Rules in a staging environment. Test with a copy of your production data to catch issues early.

If you’re using /odoo-integration.html with external systems, ensure the integration user has the correct access rights for all models it interacts with. External integrations often break after upgrades due to stricter access controls.

Deployment and operations risks to avoid

Access control mistakes don’t just cause workflow breaks—they pose real operational and security risks. Here’s what to watch for during deployment and daily operations.

Risk 1: Over-permissive groups

Assigning Manager roles to users who only need basic access is a common mistake. For example, granting Accounting / Manager to a junior accountant who only needs to view invoices.

Impact: Users can delete records, modify financial data, or change system settings unintentionally.

Fix: Use the principle of least privilege. Assign the minimal access rights necessary for each role. Create custom groups if the standard ones don’t fit.

Risk 2: Conflicting custom modules

Custom modules in /odoo-custom-addons.html often override access rights. A module might add a new model but forget to assign access rights to the relevant groups.

Impact: Users see errors like AccessError: Missing read rights on model 'custom.model' or blank screens.

Fix: After installing a custom module, test access for all affected groups. Check the module’s Access Rights tab and update groups as needed. Document the required access for future upgrades.

Risk 3: Ignoring record rules in integrations

If you use /odoo-integration.html to sync with eCommerce or CRM systems, ensure the integration user has access to all necessary models. Record rules may filter out records the integration needs to sync.

Impact: Orders, customers, or products fail to sync, causing data gaps in Odoo or the external system.

Fix: Create a dedicated Integration User group with broad access rights for models involved in integration. Assign this group to the integration user. Test syncs after any access changes.

Risk 4: Not testing after changes

Access rights are often changed during user onboarding or role changes. These changes are rarely tested thoroughly.

Impact: A user reports issues days later, and the root cause is hard to trace.

Fix: After changing access rights or groups, log in as the affected user and verify their access immediately. Use Login as User to simulate their experience.

Risk 5: Using outdated modules

Old custom modules may define access rights that conflict with newer Odoo versions. If a module hasn’t been updated for Odoo 16 or 17, its access rights may be ignored or cause errors.

Impact: Users see AccessError messages or blank screens for models provided by the module.

Fix: Review custom modules regularly. Update or replace modules that haven’t been maintained. Check /odoo-pricing.html for vendors offering updated versions of paid modules.

When to seek help

Not all access issues can be fixed with simple group or rule changes. Know when to escalate to a developer or consultant.

Seek help if you encounter any of the following:

• Persistent AccessError: Users see AccessError: Missing read rights on model 'x' even after rights are corrected. This may indicate a bug in Odoo, a conflicting module, or a PostgreSQL permission issue.
• Blank screens or missing buttons after rights changes. This can happen if access rights are overridden by Python code in a module.
• Data leakage: Users can see records they shouldn’t, despite correct group assignments. This points to a misconfigured record rule or a bug in Odoo’s security model.
• Upgrade breaks access: After an Odoo upgrade, users lose access to models or records they previously had. This may require reviewing new security models or module compatibility.
• Custom module conflicts: A module you installed or updated is causing access issues. The module’s developer or a consultant may need to review its code.

If you’re unsure, document the steps you’ve taken and the symptoms. Share the user’s group assignments, the access rights for the group, and any relevant record rules. This information will help a consultant diagnose the issue faster.

Action checklist: Do this today

Use this checklist to review and fix access control issues in your Odoo instance. Complete each step in order.

1. Identify the affected users and models:

   • List users reporting issues (e.g., warehouse, sales, accounting).
   • Note which models they can’t access (e.g., sale.order, account.move).

2. Check group assignments:

   • Open Settings > Users & Companies > Users.
   • Open each affected user and review the Groups tab.
   • Compare with a working user in the same role.

3. Review access rights for the group:

   • Open Settings > Users & Companies > Groups.
   • Open the group assigned to the affected users.
   • Go to the Access Rights tab and verify permissions for the affected models.

4. Check record rules:

   • Go to Settings > Technical > Record Rules.
   • Filter for the affected model (e.g., sale.order).
   • Review rules assigned to the group. Simplify or correct domains as needed.

5. Test the fix:

   • Log in as an affected user or use Login as User.
   • Verify that the user can now see and edit the expected records.
   • Check that restricted records are hidden.

6. Document the change:

   • Record the groups, access rights, and record rules you updated.
   • Update your internal documentation or runbook.
   • Inform the affected users that the issue is resolved.

If the issue persists after completing this checklist:

• Check for custom modules in /odoo-custom-addons.html that may override access rights.
• Review Odoo version differences if you recently upgraded.
• Escalate to a developer or consultant with the symptoms and steps you’ve taken.

Key takeaways and next steps

Access control mistakes in Odoo are common but easy to fix once you know where to look. The root cause is almost always a misconfiguration in group assignments, access rights, or record rules—not a bug in Odoo itself.

Remember these key points:

• Access rights define what actions users can perform. Record rules define which records they can see.
• Always check group assignments first. A user without the right group won’t have any access rights.
• Test changes immediately by logging in as the affected user or using Login as User.
• Custom modules in /odoo-custom-addons.html often override access rights. Review them after changes.
• Odoo 15+ has stricter access controls. Upgrades can break previously working configurations.

Your next step is to run the action checklist above for your most critical users. Pick one role (e.g., Sales User) and verify their access rights and record rules today. Don’t wait for users to report issues—proactively check access whenever roles change or after upgrades.

If you’re responsible for multiple Odoo instances or plan to upgrade soon, review access rights in a staging environment first. This prevents workflow breaks in production.

Finally, if you’re using /odoo-integration.html, ensure your integration user has the correct access rights for all models involved in syncs. Integration failures are often caused by overlooked access issues.

Take action now: pick one user role and run the checklist. Fixing access issues early prevents workflow disruptions and data security risks down the line.

Practical Next Step

Check your Odoo access rules in 5 minutes

FAQ