A frequently asked question: "Why does an employee with invoicing access only see figures in the dashboard that are none of their business?" Think of the administrative assistant who can suddenly view revenue per branch. The answer lies in how Odoo stacks rights (groups) — and how dashboards interpret that interplay.
How Odoo structures rights
Odoo works with access groups per module. Invoicing, for example, has: Billing, Accountant, Adviser. A user who only has "Billing" can post invoices, but should not see the P&L.
The problem arises when someone also has Dashboard or Reporting rights at a higher level — they then still get to see charts with data their group rights would not normally reach. Rights stack in Odoo: the broadest group wins.
Checking which rights someone has
As admin: Settings → Users & Companies → Users. Open the user. On the Access Rights tab you can see which role is active per module. Additional rights are under Other and Technical — that is precisely where the surprises often lurk, because those boxes were once ticked "just temporarily".
What you usually need to switch off
- Dashboard/Reporting rights on modules the user should not be working in
- User access rights is sometimes enabled by default for portal users — always switch it off
- Technical Features should only be enabled for genuine administrators
Record Rules for fine-grained control
For truly granular control (for example "employee A only sees his own projects") you use Record Rules. Via Settings → Technical → Record Rules you set a filter per model that applies to specific groups. That way an account manager only sees the orders of his own customers, even when he opens the Sales report. Note: record rules are powerful but unforgiving — test them thoroughly before you unleash them on an entire department.
Test before you go live
In Odoo.sh, always create a staging copy first and test rights with test users. Enable the impersonate function in developer mode: you then log in as the user in question and see exactly what they can and cannot see, before the change goes live. After that, schedule a six-monthly rights audit — roles erode faster than you think.
Practical tip: define one standard permissions profile per role (inside sales, warehouse, administration) and only deviate from it with good reason. Need help cleaning up your permissions structure? Contact DAADit Group or start the free Business Scan.
Start the Business Scan →A frequently asked question: "Why does an employee with only billing access see figures in the dashboard that have nothing to do with them?" Think of the admin clerk who can suddenly browse revenue per branch. The answer lies in how Odoo stacks permissions (groups) — and how dashboards interpret that interplay.
How Odoo structures permissions
Odoo works with access groups per module. Billing, for example, has: Billing, Accountant, Adviser. A user who only has "Billing" can post invoices, but should not see a profit and loss statement.
The problem arises when someone also has Dashboard or Reporting permissions at a higher layer — then they still get to see charts with data that their group permissions would normally not reach. Permissions stack in Odoo: the broadest group wins.
Checking which permissions someone has
As admin: Settings → Users & Companies → Users. Open the user. On the Access Rights tab you see per module which role is active. Extra permissions live under Other and Technical — that is exactly where the surprises usually hide, because those boxes were once ticked "just temporarily".
What you usually need to disable
- Dashboard/Reporting permissions on modules the user should not work in
- User access rights is sometimes enabled by default for portal users — always turn it off
- Technical Features should only be granted to genuine administrators
Record Rules for fine-grained control
For truly granular control (e.g. "employee A only sees their own projects") you use Record Rules. Via Settings → Technical → Record Rules you set a filter per model that applies to specific groups. This way an account manager only sees the orders of their own customers, even when opening the Sales report. Note: record rules are powerful but unforgiving — test them thoroughly before rolling them out to a whole department.
Test before you go live
On Odoo.sh, always create a staging copy first and test permissions with test users. Enable the impersonate function in developer mode: you then log in as the user in question and see exactly what they can and cannot see, before the change goes live. After that, schedule a permissions audit every six months — roles drift faster than you think.
Practical tip: define one standard permissions profile per role (inside sales, warehouse, administration) and deviate only with a documented reason. Need help cleaning up your permissions structure? Contact DAADit Group or take the free Business Scan.
Start the Business Scan →