Access rights: groups, rules and what they mean

Jaah never grants a right to a person directly. A user belongs to groups, and the groups carry everything: which menus appear, which models may be read, written, created or deleted, and which records of those models are reachable. The user form only decides which groups a user gets, through a role and one choice per app. This page explains the layers from the top down, so that an access error can be traced back to the group or the rule that caused it.

Roles: User, Administrator, Portal

Open a user from Settings/Users & Companies/Users and look at the Access Rights tab. The Roles group holds a single choice, Role: User or Administrator. Behind it stand two groups. Role / User gives access to the home menu and to the apps you grant below. Role / Administrator adds access to the settings that configure the apps: General Settings and the Apps app are shown to administrators only, and only they can save a settings page or install, upgrade and uninstall an app. The administrator role also implies the group Access Rights, which opens the Settings app with Users & Companies and allows creating and editing users. Changing the role swaps those two groups and keeps every other group of the user. External people (customers on the portal, visitors of the website) carry Role / Portal or Role / Public; the Users list hides them behind its default filter Internal Users and shows them under Portal Users.

Privileges: one choice per app

Below the roles, the tab lists the installed apps grouped by category. Each line is a privilege: one selection whose options are the groups of that app, ordered from the lightest to the fullest, and an empty option that means no access to that app. A group can imply other groups, and the fuller group of a privilege implies the lighter ones, which is why one choice is enough. Under Master Data two privileges exist on every database: Export, whose group Allowed says who may export data, and Contact, whose group Creation says who may create contacts. Groups that belong to no privilege, such as Access Rights, Technical Features and Multi Companies, are listed only in developer mode, in an Extra Rights section at the end of the tab.

Access rights: what a group may do with a model

Every model (a kind of record, such as contacts or users) has a list of access rights, visible in developer mode under Settings › Technical › Security › Access Rights. Each line names a Model and a Group and ticks four boxes: Read Access, Write Access, Create Access and Delete Access. A line without a group applies to every user. A user who belongs to several groups gets the union of their lines: it is enough that one group grants the operation. When none does, the action stops with a message of the form "You are not allowed to access 'Contact' (res.partner) records." (or to modify, create or delete them), followed by This operation is allowed for the following groups: and their names, and by Contact your administrator to request access if necessary. The message names the group to grant.

Record rules: which records

Access rights say what a group may do with a model; record rules say which records. A rule, found under Settings › Technical › Security › Record Rules in developer mode, belongs to one Model, carries a filter under Rule Definition (Domain Filter) and ticks the operations it applies to: Read, Write, Create, Delete. The box Groups (no group = global) sets its scope. The rule form itself states the interaction: global rules are restrictions that cannot be bypassed and are combined with AND; rules of a group grant additional permissions, are combined with OR, and stay within the bounds of the global ones. The best-known global rule is the multi-company rule. On contacts, for instance, the rule res.partner company shows a record only when it has no company or when its company is among the companies you selected in the company switcher; contacts of internal users are always visible. When a rule blocks you, the message says you have stumbled upon records you may not access, and in developer mode it adds Blame the following rules: with their names.

Defaults for new users and where to audit

A new user receives Role / User plus the groups implied by the group Default access for new users. The link Default Access Rights in the Permissions block of General Settings opens that group in the window Edit new user default group: whatever you tick there applies to every user created afterwards, through New in the Users list or through Invite New Users. To audit a group, turn on developer mode and open Settings › Users & Companies › Groups: the group form lists its Users, the Inherited groups, its Menus, Views, Access Rights and Record Rules. One group is special: Technical Features is implied by Role / User, so everyone has it, but it only counts while the session is in developer mode; that is what keeps the technical menus out of sight the rest of the time.

FAQ

Why does a user see a menu but get an error inside it?

A menu is shown when one of the user's groups is on it; the records behind it are checked by access rights and record rules. Grant the app's privilege rather than the menu, and read the error: it names the groups that are allowed.

I granted a group, but the user still cannot see the records

Look for a record rule, most often the multi-company rule. The user's Companies and Default Company fields on the Access Rights tab (shown when more than one company exists) decide which companies they may select, and the company switcher decides which ones are selected right now.

Does developer mode give more rights?

No. It only lets the Technical Features group count, which reveals technical menus and fields. Reading, writing, creating and deleting stay governed by the same access rights and record rules.