# Access rights: groups, rules and what they mean

A user's rights come from groups. A group carries access rights per model (read, write, create, delete) and record rules that filter which records are reachable; roles, privileges and the default group decide which groups a user gets.

Jaah never grants a right to a person directly. A user belongs to groups, and the groups carry everything: which menus appear, which models may be read, written, created or deleted, and which records of those models are reachable. The user form only decides which groups a user gets, through a role and one choice per app. This page explains the layers from the top down, so that an access error can be traced back to the group or the rule that caused it.

## Roles: User, Administrator, Portal {#roles}

Open a user from **Settings/Users & Companies/Users** and look at the **Access Rights** tab. The **Roles** group holds a single choice, **Role**: **User** or **Administrator**. Behind it stand two groups. *Role / User* gives access to the home menu and to the apps you grant below. *Role / Administrator* adds access to the settings that configure the apps: **General Settings** and the Apps app are shown to administrators only, and only they can save a settings page or install, upgrade and uninstall an app. The administrator role also implies the group *Access Rights*, which opens the Settings app with **Users & Companies** and allows creating and editing users. Changing the role swaps those two groups and keeps every other group of the user. External people (customers on the portal, visitors of the website) carry *Role / Portal* or *Role / Public*; the Users list hides them behind its default filter **Internal Users** and shows them under **Portal Users**.

## Privileges: one choice per app {#privileges}

Below the roles, the tab lists the installed apps grouped by category. Each line is a privilege: one selection whose options are the groups of that app, ordered from the lightest to the fullest, and an empty option that means no access to that app. A group can imply other groups, and the fuller group of a privilege implies the lighter ones, which is why one choice is enough. Under **Master Data** two privileges exist on every database: **Export**, whose group **Allowed** says who may export data, and **Contact**, whose group **Creation** says who may create contacts. Groups that belong to no privilege, such as *Access Rights*, *Technical Features* and *Multi Companies*, are listed only in developer mode, in an **Extra Rights** section at the end of the tab.

## Access rights: what a group may do with a model {#access-rights-per-model}

Every model (a kind of record, such as contacts or users) has a list of access rights, visible in developer mode under Settings › **Technical** › **Security** › **Access Rights**. Each line names a **Model** and a **Group** and ticks four boxes: **Read Access**, **Write Access**, **Create Access** and **Delete Access**. A line without a group applies to every user. A user who belongs to several groups gets the union of their lines: it is enough that one group grants the operation. When none does, the action stops with a message of the form "You are not allowed to access 'Contact' (res.partner) records." (or to modify, create or delete them), followed by **This operation is allowed for the following groups:** and their names, and by **Contact your administrator to request access if necessary.** The message names the group to grant.

## Record rules: which records {#record-rules}

Access rights say what a group may do with a model; record rules say which records. A rule, found under Settings › **Technical** › **Security** › **Record Rules** in developer mode, belongs to one **Model**, carries a filter under **Rule Definition (Domain Filter)** and ticks the operations it applies to: **Read**, **Write**, **Create**, **Delete**. The box **Groups (no group = global)** sets its scope. The rule form itself states the interaction: global rules are restrictions that cannot be bypassed and are combined with AND; rules of a group grant additional permissions, are combined with OR, and stay within the bounds of the global ones. The best-known global rule is the multi-company rule. On contacts, for instance, the rule *res.partner company* shows a record only when it has no company or when its company is among the companies you selected in the company switcher; contacts of internal users are always visible. When a rule blocks you, the message says you have stumbled upon records you may not access, and in developer mode it adds **Blame the following rules:** with their names.

## Defaults for new users and where to audit {#defaults-and-auditing}

A new user receives *Role / User* plus the groups implied by the group **Default access for new users**. The link **Default Access Rights** in the **Permissions** block of General Settings opens that group in the window **Edit new user default group**: whatever you tick there applies to every user created afterwards, through **New** in the Users list or through **Invite New Users**. To audit a group, turn on developer mode and open Settings › **Users & Companies** › **Groups**: the group form lists its **Users**, the **Inherited** groups, its **Menus**, **Views**, **Access Rights** and **Record Rules**. One group is special: *Technical Features* is implied by *Role / User*, so everyone has it, but it only counts while the session is in developer mode; that is what keeps the technical menus out of sight the rest of the time.

## FAQ {#faq}

### Why does a user see a menu but get an error inside it? {#menu-visible-but-error}

A menu is shown when one of the user's groups is on it; the records behind it are checked by access rights and record rules. Grant the app's privilege rather than the menu, and read the error: it names the groups that are allowed.

### I granted a group, but the user still cannot see the records {#granted-but-cannot-see}

Look for a record rule, most often the multi-company rule. The user's **Companies** and **Default Company** fields on the **Access Rights** tab (shown when more than one company exists) decide which companies they may select, and the company switcher decides which ones are selected right now.

### Does developer mode give more rights? {#does-developer-mode-give-rights}

No. It only lets the *Technical Features* group count, which reveals technical menus and fields. Reading, writing, creating and deleting stay governed by the same access rights and record rules.

---

- Source: https://jaah.app/docs/general-settings/access-rights-groups-and-rules
- Updated: 2026-10-13
- Version: General settings and administration 19.0.1.0