How to restrict payroll access in Odoo
Payroll is usually the single most sensitive model set in a company's Odoo instance, and the mistake worth avoiding is treating it like the rest of HR. Give it its own Access Profile: salary and bank-account fields masked or invisible outside a named payroll team, Export and Delete off for everyone except that team, and a record rule that doesn't inherit the broader HR "own + subordinates" scope by default.
Give payroll its own profile
Don't extend general HR access to payroll models — treat it as a separate, narrower grant.
Mask compensation fields by default
Salary, bonus, and bank-account fields masked for anyone outside the named payroll team, including most of HR.
Turn off Export and Delete broadly
Very few people who can view a payroll record should be able to export or permanently remove it.
Review the profile periodically
Payroll access is one of the more common examples of a permission that outlives the reason it was granted — export the profile as JSON and check it against current staff every so often.
Payroll is not an HR subgroup. It is a separate grant.
HR Officer in native Odoo is already too wide for compensation. Payslips, salary structures, and bank details for wages are a smaller set of models and a smaller set of people. Give payroll its own Access Profile. Do not extend “HR can see employees” into “HR can export every wage.”
Mask or hide wage, bonus, and employee bank fields for everyone outside that named team — including most of HR. Field-level security · masking. Export and Delete off almost universally. Disable export.
Payroll access should expire more often than HR access
Year-end auditors, maternity cover, and “just this payroll run” are normal. A start and end date on the profile beats a group someone forgets to remove in March. Review the JSON export of the profile against the current payroll calendar.
Record rules should not inherit a broad HR “all employees” scope. Payroll users see the people they must pay, not the whole historical roster, unless they are the payroll lead.
No payroll on an AI bot user
An MCP or JSON-2 bot that can search_read payslips is a data leak with a prompt. Do not put payroll models on the agent user. If a manager wants “summarise overtime,” build a named tool on a non-sensitive aggregate, not raw payslip read. Odoo MCP security.
This is also a GDPR access-minimisation example — GDPR and data access — not a reason to claim a module makes you compliant.
The rest of the cluster
Before you set it up
Should payroll access ever be time-boxed?
Often yes — a temporary payroll administrator covering a leave, or a year-end auditor, is a natural fit for start/expiry dates rather than a permission someone has to remember to revoke.
Should payroll share the HR Officer group?
No. Native HR Officer is too wide for wages and bank details. Use a separate Access Profile. Restrict HR users.
Can an AI agent read payslips?
Not on a general ERP bot user. Keep payroll models off MCP tools. Odoo MCP security.
Ready to lock this down?
Try it on the live sandbox first — nothing to install.