How to prevent users from editing records in Odoo
Two options depending on scope: turn off the model's Edit switch to block editing entirely, or set specific fields to Read Only if only part of the record should be locked. Most "stop users changing data" requests are actually the second case — someone should be able to update a status field but not the amount, for instance.
Decide if it's the whole record or specific fields
Whole-record: turn off Edit at the model level. Partial: set individual fields to Read Only instead.
Apply it to the right profile
Different profiles can have different edit rights on the exact same model.
Remember this holds over the API too
An integration writing to the model is bound by the same rule as someone using the form.
A read-only form view is not a write right
Making a form look locked does not stop write through list-editable, import, automated actions, or the API. Turn off the model’s Edit/Write switch when the role is truly read-only. Use field Read Only when they must still change status, add a note, or confirm a receipt.
The usual real request is mixed: warehouse can edit quantity on draft receipts, not unit price; sales can edit discount in draft, not after lock. That is field rules plus native states, not one “no edit” group.
Respect posted, paid, and done
Odoo already stops edits on many posted documents. If users are still changing amounts after confirm, you have a group that includes cancel/draft rights they should not have, or a custom module that bypasses the state. Fix that before adding a field widget.
For AI agents the same rule applies: do not expose write on posted invoices. Named tools, read-only first — Odoo MCP security.
Model Edit off, or fields Read Only?
Ask what they must still change this week. If the list is empty, model Write off. If the list is three fields, Read Only on the rest. If the list is “everything except salary,” you wanted Invisible or masked fields, not a frozen form.
Always test with an API write if that user can have a key. UI-only locks fail that test every time. Nine model switches is the map.
The rest of the cluster
Before you set it up
Should I lock the whole model or just some fields?
Lock the model’s Edit switch only when they should never change anything. Most requests are field-level: amount locked, status still editable. Read-only by group.
Does a read-only form view stop API writes?
No. Enforce write rights and field access on the server. Field-level security.
How is this different from preventing deletion?
Edit and Delete are separate rights. Prevent deletion if the risk is unlink, not write.
Ready to lock this down?
Try it on the live sandbox first — nothing to install.