Groups and access rights

res.groups, implied groups, privileges/categories, and ir.model.access.csv rights for every model you create.

In this lesson

Groups, implied groups and categories
ir.model.access.csv
Field and UI restrictions vs enforcement

Key points

res.groups with implied_ids and app categories; Odoo 20 fewer groups, logged changes
Every new model needs access lines
CSV: id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink
UI groups hide; access rights and rules enforce

Real-world example

A new model had access granted with an empty group_id, so portal users could read every credit release through the API. Changing the line to the internal user group (read) and credit controllers (all) closed it; a test now asserts portal users get AccessError.

Questions and answers

What is model_credit_release?

The external ID Odoo generates for the ir.model record of credit.release.

What does implied_ids do?

Members of this group automatically get the implied groups.

Read the full lesson, worked example and quiz