Loading page
Access X-Ray
by TechnoVision · Odoo App
“Show me everyone who can see employee salaries” is a database query today, and most administrators cannot write it. The answer is not on any screen because it is not stored anywhere - it is the accumulated result of four mechanisms stacked on each other. Access X-Ray resolves all four.
One-off licence per Odoo instance. The store bills in its own base currency, so checkout may differ by a few cents.
Security Center
Live82
Score
1.2k
Events / 24h
3
Alerts
Export volume · 14 days
Unusual export detected
res.partner · 4,812 rows · outside business hours
Illustrative UI. Product screenshots to be dropped into this frame.
What it does
Every model an account can read, write, create or delete - and the group that granted each one. The onboarding and offboarding question, answered.
Who can touch hr.payslip, through which group, with unconstrained accounts listed separately. The auditor question, answered.
Side by side with the differences highlighted, for "make the new joiner like her, minus the finance bits".
Not "can delete invoices" but "because Billing Manager implies Accounting / Billing, which grants unlink on account.move".
If two groups grant the same right, both are named - so you are never sent to remove one and find that nothing changed.
Settings access, delete rights on sensitive models, accounts that can rewrite the rules, dormant accounts holding full access. Each names the accounts and what to do.
Group inheritance transitively, model access as the union across every group held, global record rules ANDed and group rules ORed, and the accounts that bypass all of it.
It reads users, groups, access rules and record rules and writes nothing but its own findings. An automated test in the module asserts exactly that.
Screenshots
4 reserved slots at 16:10, ready for real captures.
How it works
Depends on base only. It drags nothing else into your database and needs no external Python packages.
Pick a user or a model. The resolved answer comes back with the path that produced every line of it.
Put two accounts side by side, see the differences, then make the change in Odoo where permissions actually live.
Risk findings surface unconstrained accounts and dormant administrators, each naming the accounts and the action to take.
FAQ
No, and that is deliberate. It shows you what is true; you change it in Odoo. It is safe to install on a production database, and there is a test in the module that asserts it writes nothing but its own findings.
Not in this version. Field groups= attributes are not resolved. It covers model access rules, record rules and group inheritance.
No. They compose where both are present and neither requires the other. Security & Audit Center is the timeline - what happened. Access X-Ray is the map - who can make it happen.
No external service and no outbound connection. Access data never leaves your Odoo.
Install from Odoo Apps, or talk to us about a guided rollout across multiple companies.