FAQ
The questions asked most often about Access X-Ray, answered.
Can it change permissions?
No, and that is deliberate. It reads users, groups, access rules and record rules, and writes nothing but its own findings and query results. There is an automated test in the module asserting it. You change permissions in Odoo, where they live; Access X-Ray tells you what changing them will actually do.
Is it safe to install on production?
Yes. It is read-only, depends on base alone, makes no outbound connection, and adds no behaviour to any existing model beyond a group count and a button on the user form.
Why does removing a group sometimes change nothing?
Because model access is a union, not an intersection, and there is no deny. If two groups grant unlink on account.move, removing one leaves the other. This is the single most common source of "we already fixed that" in Odoo permissions, and it is why the Granted by column names every granting group rather than the first one found.
Why did adding a group make someone see more records, not fewer?
Because group record rules OR together. Global rules AND — they always narrow. Group rules widen: each additional group rule adds an alternative path to a record. A change that reads like a tightening can be a loosening, and Access X-Ray shows the two kinds of rule separately for exactly this reason.
Does it analyse field-level access?
Not in this version. Field groups= attributes are not resolved. A user reported as able to read a model may still be unable to see particular fields on it. Model access rules, record rules and group inheritance are all resolved.
Why is it restricted to Settings users?
Because the output is a map of who can reach what, which is precisely the reconnaissance you would not want to hand out. Anyone who could be trusted with this report can already read ir.model.access and ir.rule and work it out by hand — the module removes the hours, not the privilege. See SECURITY.md.
Why does the report say "this account bypasses access control" instead of listing permissions?
Because for the superuser or a Settings-group account, a permission list is misleading. The honest answer is "everything", and printing a list of specific grants would suggest limits that do not exist.
Does it need Security & Audit Center?
No. They compose where both are present and neither requires the other. Security & Audit Center is the timeline — what happened. Access X-Ray is the map — who can make it happen.
Why does it depend only on base?
So it can be installed on the databases that most need it. A governance tool that pulls in accounting or HR to be installed cannot be installed on a database that has neither, which is often exactly the database with the messiest permissions.
Can I change what counts as a "sensitive" model?
Yes — SENSITIVE_MODELS in models/access_finding.py. The list is deliberately short: a list long enough to flag everything flags nothing. See CONFIGURATION.md.
Can I change the 90-day dormancy threshold?
Yes, on the scan itself, before running it. It is a field rather than a constant so an organisation reviewing quarterly can match its own cycle.
Does anything leave our instance?
No. No external service, no outbound connection, no telemetry, no licence check.
Does it work on Odoo Community?
Yes — Community and Enterprise, 18.0.
Will there be an Odoo 17 or 19 build?
Ask at info@technovision.dev. Version support is on the roadmap and demand decides the order.