FAQ
The questions asked most often about Restrict Delete & Export, answered.
Could we lock ourselves out of our own data?
No, and three separate things prevent it.
The superuser always bypasses, and that cannot be switched off. The module's own models can never be restricted, so a rule can always be lifted. And 25 of Odoo's management models are refused by the form — res.users, res.groups, ir.model.access, ir.rule, ir.module.module and the rest — so you cannot restrict your way out of administering the database.
Why an allow-list instead of a deny-list?
Because a deny-list stops being verifiable the moment someone belongs to several groups. With a deny-list, "who can delete invoices?" depends on every group the person is not in. With an allow-list it is the rule, read once.
Does it block exports through the API?
No, and this is the most important limitation to understand before buying.
Custom controllers, XML-RPC and JSON-RPC calls, and third-party report engines do not pass through the funnel this module monitors. Deletes performed with raw SQL are also unaffected — nothing at the ORM level can be.
This module governs what people do through the Odoo interface. It is a control on ordinary users doing ordinary things. It is not a defence against someone with API credentials and an intent to take data.
What does it cost in performance?
A cached lookup that returns immediately for any model without a rule, and it runs on delete, copy and archiving writes only — never on reads or on ordinary edits. The cache is invalidated when a rule changes.
What happens if the configuration cannot be read?
The operation proceeds. The module fails open, deliberately: a bug in a monitoring tool must not become a business outage. A restriction that silently stops working is a smaller problem than a database nobody can use.
Someone was blocked and I do not know why
Open the blocked-attempts log. It records who, when, which operation, which model and how many records. The point of the log is to find the rule that is getting in the way, not the person who tripped it.
Can one model have two rules?
No — one rule per model, enforced by a database constraint. Restrictions on a model are therefore always readable in one place instead of assembled from several rows.
Can I restrict only some records of a model?
Not with this module. It works at the operation-and-model level. Per-record scoping is what Odoo's own record rules are for, and the two compose: this module decides whether someone may delete, record rules decide which records they can see at all.
Does it stop the superuser?
No, by design. See the first answer.
Will Settings users be restricted?
Not by default — there is a global Settings users bypass switch, on out of the box. Turn it off once you are confident the rules are right.
How long are blocked attempts kept?
180 days by default, pruned by a cron. Set the retention to 0 to keep them indefinitely. Logging can also be disabled globally or per rule.
How does this relate to Security & Audit Center?
This one stops the operation. That one records everything that did happen, with a Security Score and alerting. Neither requires the other, and they are useful together: a rule that blocks, and a trail of what got through.
Does it work on Odoo Community?
Yes — Community and Enterprise, 18.0.