How to make an Odoo field read-only for one group
Set the field's state to Read Only for the specific Access Profile that shouldn't edit it. Unlike Invisible, the value stays visible — the group can see it, just not change it, which is the more common request in practice: most fields don't need hiding, they need protecting from an accidental edit.
Pick the model and field
The same field can carry different states for different profiles at once.
Set Read Only for the group that shouldn't edit it
Other profiles keep full edit rights unless you restrict them too.
Combine with Required if needed
A field can be Read Only for one profile and Required for another on the same record.
View readonly is a hint. Field access is a refusal.
attrs="{'readonly': ...}" and Studio’s read-only flag stop the widget from editing. They do not stop write() from a server action, an import, a related model’s inverse, or the API. Anyone who can call write on the model can change a “locked” amount unless field access says otherwise.
Access Manager Pro’s Read Only state is server-side for that profile. The value stays visible — that is the point versus Invisible. Sales still sees credit limit; finance still owns it.
When you actually wanted to block the whole edit
If the group should not change anything on the record, turn off the model’s Edit/Write switch. Read Only on twenty fields is how you miss the twenty-first. Prevent users editing records is that coarser control.
Posted invoices, locked inventory moves, and paid bills already have native state machines. Do not fight those with field widgets. Use native posted/locked behaviour, then add field rules for the fields that stay editable in draft.
Imports will tell you if it is real
Have the restricted user import a CSV that changes the supposedly read-only column. If the import succeeds, you had UI. If it fails with an access error, you have field access. Repeat with XML-RPC or JSON-2 if they are allowed an API key.
Conditional read-only (“locked after confirm”) is the common real requirement. That is a field rule with a condition, not a second view. Field-level security covers conditions and dropdown limits.
The rest of the cluster
Before you set it up
Is attrs readonly real security?
No. View readonly is UI. A user can still write the field over the API unless field access says otherwise. Field-level security.
When should I hide the field instead?
When the group should not see the value at all — salary, bank account, national ID. Hide fields by group.
Does Read Only block imports and RPC writes?
Only if it is enforced on the server for that group, not just on one form view.
Ready to lock this down?
Try it on the live sandbox first — nothing to install.