How to Implement Record Rules vs. Access Rights in Odoo?
Understanding of Record Rules vs. Access Rights in Odoo
✅ What’s the Difference?
Feature |
Access Rights |
Record Rules |
| Scope | Model-level (create, read, write, delete) | Record-level (row-level access control) |
| Where Defined | ir.model.access.csv or UI (Settings > Technical > Security > Access Controls) | In UI (Settings > Technical > Security > Record Rules) |
| What It Controls | If a user can access a model | Which records the user can access |
| Enforced On | ORM operations | ORM filters & queries |
📌 Real Use Case 1: Sales User should not delete Sale Orders
✅ Access Right Setup:
In ir.model.access.csv for model sale.order:
id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
sales_order_user,sales_order_user,model_sale_order,sales_team.group_sale_user,1,1,1,0
- This allows reading, writing, creating Sale Orders, but prevents deleting.
📌 Real Use Case 2: User should only see their own customers
✅ Record Rule Setup:
Model: res.partner
[(‘user_id’, ‘=’, user.id)]
- Only allows users to view customers assigned to them.
- This does not restrict the model access; it filters visible records.
🧪 Realistic Combined Scenario
Imagine you have a project.task model:
- Access Right gives the user rights to read/write.
- Record Rule restricts visibility to only tasks in projects where the user is a member.
Example Rule:
[(‘project_id.user_ids’, ‘in’, [user.id])]
This ensures that:
- User can only view/write tasks where they are a project member.
- Even with write access, they cannot modify tasks outside their scope.
✅ Summary Table
Feature |
Access Rights |
Record Rules |
| Setup Location | ir.model.access.csv / UI | UI (Record Rules) |
| Granularity | Coarse (whole model) | Fine (specific records) |
| Applies To | CRUD permissions | Filtering domain per user |
| Skipped When | Using sudo() | Using sudo() |
| Enforced In | ORM methods | Search, browse, write, etc. |
⚠️ Best Practices
- Always define both access rights and record rules.
- Use record rules for dynamic record visibility.
- Use access rights for controlling general actions like delete/write.
