How to limit employee permissions in Odoo
Limiting an employee's permissions in Odoo touches three layers, and most native setups only cover the first: which models they can open (Model Permissions), which fields they can see or edit within those models (Field Permissions), and which specific records they can reach (record rules). Access Manager Pro configures all three from one Access Profile.
Start with the model
Turn off what they shouldn't be able to do — export, delete, duplicate — not just what they can't see.
Narrow the fields
Mask or hide anything sensitive that isn't relevant to their role.
Scope the records
Add a record rule if they should only reach their own work, their team's, or one company's.
Employee permissions are three layers, not one group
Most “limit what employees can do” tickets mix three jobs. Models: can they open sales orders at all? Fields: on that order, can they see margin? Records: whose orders — their own, the team, the company? Odoo documents these as access rights, field access and record rules. Native groups can express all three, badly, with enough XML. One Access Profile can carry all three without a new group per tweak.
Start at model level (access rights management), then fields (field-level security), then rows (restrict records). Reversing that order hides symptoms.
The permission that fails on day one of a new hire
A hand-maintained group list is stale the week someone joins. Profiles that enrol on first login from department or job position exist because “we’ll add them to the right group” is the most common access failure in Odoo, not a missing record rule.
Contractors and temps should expire. Permanent staff should not inherit last year’s extra rights because nobody removed a group. Export the profile as JSON and review it when the org chart changes — the same habit as payroll reviews.
Do not clone Administrator and subtract
Copying Settings / Administration and turning things off is how you leave Export, technical menus, and API keys in place. Build the employee profile from the work they do: the models they open every day, the fields they must see, the records they own. Add, do not subtract from admin.
If the request is “they should only edit their own timesheets,” that is a record rule, not a hidden menu. If it is “they should not see salary,” that is a field state, not a group named Employee.
The rest of the cluster
Before you set it up
What are the three layers of employee permissions?
Models they can open, fields they can see or edit, and records they can reach. Odoo documents these as access rights, field access and record rules. Access rights management.
Can I do all three in native groups?
You can, with enough groups and XML. Most teams stop at model rights and leave field and row gaps. Field-level security covers the field gap.
Where do record rules fit?
They limit which rows a user sees after they are allowed on the model. Record rules without code.
Ready to lock this down?
Try it on the live sandbox first — nothing to install.