Loading page
Restrict Delete & Export
by TechnoVision · Odoo App
Odoo's access rights are per-model and per-operation, which sounds like enough until you try to use them. Pick a model, list the groups that may still act, and everyone else is refused with a message you write.
Security Center
Live82
Score
1.2k
Events / 24h
3
Alerts
Export volume · 14 days
Unusual export detected
res.partner · 4,812 rows · outside business hours
Illustrative UI. Product screenshots to be dropped into this frame.
What it does
Delete, export, print, archive and duplicate - each restricted independently, and delete covers unlink from the interface, the API or a server action.
Once a rule restricts an operation, only the listed groups may perform it. A deny-list stops being verifiable the moment a user belongs to several groups.
You write the message. "Archive the contact instead, or ask a Contact Manager" generates far fewer support tickets than a bare Access Denied.
Who, when, which operation, which records and from which address - so you can find the rule that is getting in the way rather than the person.
The superuser always bypasses and this cannot be switched off. Settings-group users bypass by default until you turn that off deliberately.
res.users, res.groups, ir.model.access and ir.rule can never be restricted, and neither can the app own records. Python-level guarantees, not settings.
If the configuration cannot be read, the operation proceeds. A monitoring bug must not become a business outage.
A cached lookup that returns immediately for any model without a rule. It runs on delete, copy and archiving writes only - never on reads or ordinary edits.
Viewers read the rules and the log. Managers create and change rules and clear the log.
Screenshots
4 reserved slots at 16:10, ready for real captures of the dashboard, activity log, sensitive-change detail and report builder.
How it works
Depends on base and web only. No external Python packages, no outbound connections.
Settings - Technical - Security - Access Restrictions. Tick the operations that should be controlled.
Name the groups and users that keep the permission, and write the message everyone else will see.
Blocked attempts show which restrictions are costing people time, so rules can be corrected rather than endured.
FAQ
No. The superuser bypass cannot be disabled, critical models are refused by the form, and the app own records can never be restricted - so a rule can always be undone.
No. Custom controllers, XML-RPC and JSON-RPC, and third-party report engines do not pass through the monitored funnel. Deletes performed with raw SQL are also unaffected - nothing at the ORM level can be.
A cached lookup that returns immediately for models without a rule, on delete, copy and archiving writes only.
This one stops the operation; that one records everything that did happen, with a Security Score and alerting. Neither requires the other.
Install from Odoo Apps, or talk to us about a guided rollout across multiple companies.