User guide
How to use Access X-Ray, screen by screen.
Access X-Ray answers one question no Odoo screen answers: who can do what, right now, and why.
Everything lives under the Access X-Ray menu, visible to Settings users.
Why the user form is not the answer
Odoo's user form shows the boxes that were ticked. It does not show the result. A user's real access is the accumulated effect of four separate mechanisms:
| Layer | Why it is invisible on the form |
|---|---|
| Group inheritance | A user holds everything their groups imply, transitively. The form shows checkboxes, not the closure. |
| Model access | Rights are the union across every group held. There is no deny — which is why removing a group so often changes nothing. |
| Record rules | Global rules AND together; group rules OR together. Adding a group can widen what someone sees while reading like a tightening. |
| Superuser and Settings | These bypass access control entirely, so every other restriction is irrelevant for those accounts. |
Access X-Ray resolves all four and shows the answer with the path that produced it.
Explore → By User
"What can this account actually do?"
Pick a user. You get every model the account can read, write, create or delete, and for each one:
| Column | Meaning |
|---|---|
| Model | The technical model name, e.g. account.move |
| Read / Write / Create / Delete | The resolved permission — the union across every group held |
| Granted by | Every group that grants it, not just the first one found |
| Record rules | The global and group record rules that narrow it, kept apart because they compose differently |
Only sensitive models narrows the list to the eleven models where deletion is effectively irreversible or a quiet change moves money — see CONFIGURATION.md for the list.
If the account bypasses access control, a warning appears at the top of the result instead of a permission list. For the superuser or a Settings-group account, the permission list would be meaningless: the answer is "everything".
This is the onboarding and offboarding question, answered.
"Granted by" is the part that saves the time
Not "can delete invoices" but:
…because Billing Manager implies Accounting / Billing, which grants unlink on account.move.
And if two groups grant the same right, both are named — so you are never sent to remove one group and find that nothing changed.
Explore → By Model
"Who can touch this?"
Pick a model — hr.payslip, res.partner.bank, whatever the auditor asked about. You get every account that can reach it, through which group, with unconstrained accounts listed separately because they are a different kind of answer.
This is the auditor's question, answered: "show me everyone who can see employee salaries."
Explore → Compare Users
Two accounts side by side, differences highlighted.
The practical case is "make the new joiner like her, minus the finance bits." Instead of reading two user forms and guessing at what the inherited groups add up to, you get the resolved difference.
Run Scan → Findings
Run Scan evaluates four risk rules across the database and writes findings, ordered by weight so the heaviest is at the top.
| Finding | What it means |
|---|---|
| Administrators | Accounts that bypass access control entirely. Any number above a handful is worth explaining. |
| Delete rights on sensitive models | Accounts that can unlink records where deletion is effectively irreversible or moves money. |
| Can edit security | Accounts that can change res.users, res.groups, ir.model.access or ir.rule — that is, accounts that can rewrite the rules that constrain them. |
| Dormant with access | Accounts holding significant access that have not logged in for 90 days (adjustable on the scan). The classic audit finding. |
Each finding carries the accounts it names, a detail explaining what was found, and a recommendation — what to do about it. The count of affected users is shown on the finding so a list of one is not mistaken for a list of forty.
Re-run the scan whenever you want; it replaces the previous findings.
From a user's form
Any user's form has a group count and an action that opens the By User probe for that account directly — so the question can be asked from where it usually comes up, rather than from the Access X-Ray menu.
What Access X-Ray is not
- Not a tool for setting permissions. It shows you what is true; you change it in Odoo. It writes nothing but its own findings.
- Not field-level analysis. Field groups= attributes are not resolved in this version.
- Not a compliance certification. It is evidence you can act on, not a certificate.
How it relates to Security & Audit Center
They compose, and neither requires the other.
Security & Audit Center is the timeline: what happened. Access X-Ray is the map: who can make it happen.