How to Implement Record Rules vs. Access Rights in Odoo?

Understanding of Record Rules vs. Access Rights in Odoo


✅ What’s the Difference?


Feature

Access Rights

Record Rules

Scope

Model-level (create, read, write, delete)

Record-level (row-level access control)

Where Defined

ir.model.access.csv or UI (Settings > Technical > Security > Access Controls)

In UI (Settings > Technical > Security > Record Rules)

What It Controls

If a user can access a model

Which records the user can access

Enforced On

ORM operations

ORM filters & queries


📌 Real Use Case 1: Sales User should not delete Sale Orders


✅ Access Right Setup:


In ir.model.access.csv for model sale.order:

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

sales_order_user,sales_order_user,model_sale_order,sales_team.group_sale_user,1,1,1,0


  • This allows reading, writing, creating Sale Orders, but prevents deleting.


📌 Real Use Case 2: User should only see their own customers


✅ Record Rule Setup:

Model: res.partner

[('user_id', '=', user.id)]

  • Only allows users to view customers assigned to them.
  • This does not restrict the model access; it filters visible records.

🧪 Realistic Combined Scenario

Imagine you have a project.task model:

  • Access Right gives the user rights to read/write.
  • Record Rule restricts visibility to only tasks in projects where the user is a member.

Example Rule:

[('project_id.user_ids', 'in', [user.id])]

This ensures that:

  • User can only view/write tasks where they are a project member.
  • Even with write access, they cannot modify tasks outside their scope.


✅ Summary Table

Feature

Access Rights

Record Rules

Setup Location

ir.model.access.csv / UI

UI (Record Rules)

Granularity

Coarse (whole model)

Fine (specific records)

Applies To

CRUD permissions

Filtering domain per user

Skipped When

Using sudo()

Using sudo()

Enforced In

ORM methods

Search, browse, write, etc.


⚠️ Best Practices

  • Always define both access rights and record rules.
  • Use record rules for dynamic record visibility.
  • Use access rights for controlling general actions like delete/write.