Odoo Users & Access Rights: Complete Guide to Permissions, Security and System Administration
Managing users and access rights is one of the most important parts of any successful Odoo implementation. Odoo can bring sales, accounting, inventory, purchasing, manufacturing, CRM, HR, projects, website and eCommerce into one connected platform. But when many employees, departments and managers work in the same database, simply creating user accounts is not enough.
You need to decide:
Who can access Odoo?
Which applications can each user see?
- Which records can they read?
- Which records can they create or edit?
- Which employees can approve transactions?
- Which users should have access to financial information?
- Who can configure the system?
- Which users should be administrators?
- How can sensitive business data be protected?
- How should permissions change as employees change roles?
This is where Odoo users, access rights, security groups, and record rules become critical.
For businesses implementing Odoo in Pakistan, proper access-right configuration can make the difference between a controlled ERP environment and a system where employees have access to information they should not see.
In this guide, OdooPakistan explains how Odoo users and access rights work, how to design a practical permissions structure, common mistakes to avoid, and how we help businesses configure and customize Odoo for their real-world requirements.
OdooPakistan is the Pakistan-focused sister company of Mediod Consulting, combining Odoo implementation, consulting, customization, integration and technical expertise for businesses in Pakistan and international markets. We also collaborate with ShahidMalik.io on Odoo consulting and technical projects.
What Are Odoo Users?
An Odoo user is a person who has an account and can access an Odoo database.
Depending on the configuration, a user might work with:
- Sales
- Purchase
- Inventory
- Accounting
- Manufacturing
- Point of Sale
- Human Resources
- Projects
- Timesheets
- Website
- eCommerce
- Marketing
- Helpdesk
Other installed Odoo applications
However, not every user should have access to every application. For example, a salesperson may need access to CRM and Sales but should not necessarily have unrestricted access to Accounting.A warehouse employee may need Inventory access but should not have access to employee salaries.An accountant may need extensive Accounting access but does not necessarily need Manufacturing configuration rights.
An Odoo administrator may need broader technical and configuration permissions.
This means that Odoo user management should be designed around job responsibilities rather than simply giving everyone access to everything. A good implementation starts by understanding the organization's structure and then mapping each role to the minimum permissions required to perform its work.
Why Odoo Access Rights Matter
Access rights are not simply an administrative setting. They are part of your ERP's security architecture. Imagine a company with:
5 salespeople
2 sales managers
3 warehouse employees
2 accountants
1 finance manager
1 HR manager
1 operations manager
1 system administrator
If all 15 employees have unrestricted access, the organization loses control over sensitive information.
- A salesperson might see financial information.
- A warehouse employee might modify sales orders.
- A junior employee might change configuration.
- A user might accidentally delete or modify important records.
- The problem becomes even more serious as the company grows.
A well-designed Odoo security structure should therefore follow a principle of least privilege.
In simple terms:
Give users the access they need to do their jobs — and avoid giving them unnecessary permissions.
This approach improves security, reduces accidental changes and makes the Odoo environment easier to manage.
Odoo Users vs Access Rights vs Record Rules
These concepts are often confused, but they serve different purposes.
1. Users
Users are the people who log into Odoo.
Examples:
Ali — Salesperson
Ahmed — Accountant
Sara — HR Manager
Usman — Warehouse User
Bilal — System Administrator
Each user can be assigned different permissions.
2. Access Rights
Access rights determine what a user or group can generally do with a particular model. The common permissions are:
Read
- Write
- Create
- Delete
For example, you might allow a sales team to:
- Read customers
- Create customers
- Edit customers
- But not delete customers
- This creates a basic layer of security.
3. Record Rules
Record rules provide more granular control.
Instead of asking:
"Can this user access sales orders?"
you can ask:
"Which sales orders can this user access?"
For example, a salesperson could be allowed to see only their own quotations and sales orders. A sales manager could see the orders belonging to the entire sales team.A regional manager could see orders from their assigned region. This distinction is extremely important.
Access rights control what a user can do with a model. Record rules can control which records the user can access.
Understanding Odoo Security Groups
Odoo uses groups to organize permissions.Rather than configuring every permission individually for every employee, you can create or use groups that represent roles.
Examples include:
- Sales User
- Sales Manager
- Inventory User
- Inventory Administrator
- Accountant
- Accounting Administrator
- HR Officer
- HR Manager
- Project User
- Project Administrator
- Manufacturing User
- Manufacturing Administrator
A user can belong to one or multiple groups. This makes user management much easier. Instead of manually configuring 20 employees individually, you can create a role such as:
- Salesperson and assign the appropriate users to that group.
- When the role changes, you can update the user's groups accordingly.
Designing Odoo Roles Around Your Organization
- Before configuring access rights, we recommend creating a simple user-role matrix.
For example:
| Role | CRM | Sales | Inventory | Accounting | HR | Administration |
|---|---|---|---|---|---|---|
| Salesperson | ✓ | ✓ | Limited | No | No | No |
| Sales Manager | ✓ | ✓ | Limited | Limited | No | No |
| Warehouse User | No | Limited | ✓ | No | No | No |
| Accountant | Limited | Limited | Limited | ✓ | No | No |
| Finance Manager | Limited | Limited | Limited | ✓ | No | No |
| HR Manager | No | No | No | Limited | ✓ | No |
| System Administrator | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
This is only an example.
Every organization should design its own permissions according to its processes.
For a Pakistani trading company, for example, the structure might be:
Sales → Sales Manager → Operations → Warehouse → Finance
while a manufacturing company might have:
Sales → Planning → Manufacturing → Quality → Warehouse → Finance
The access rights should reflect these business relationships.
This is one reason we recommend business process analysis before Odoo configuration rather than simply installing applications and assigning users.Learn more about Odoo implementation in Pakistan.
How to Create an Odoo User
The exact interface can vary depending on your Odoo version and installed applications, but the general process is straightforward. An administrator can typically access the user management area through the Odoo settings.
A new user generally requires:
Name
Email/login
Language
Company
Access permissions
Application-specific permissions
Other relevant user preferences
- Once the user is created, you assign the appropriate groups.
For example:
Ahmed — Sales Executive
could receive:
CRM User
Sales User
but not:
Accounting Administrator
Inventory Administrator
Settings Administrator
This keeps the user's access aligned with their actual responsibility.
Internal Users, Portal Users and Public Users
Odoo can work with different types of users.
Internal Users
Internal users are employees or other users who need to work directly inside the Odoo backend.
Examples include:
Employees
Managers
Accountants
Salespeople
Warehouse staff
Administrators
Internal users generally require application-specific permissions.
Portal Users
Portal users typically access selected information through the customer or supplier portal.
For example:
Customers checking quotations
Customers viewing invoices
Customers tracking orders
Suppliers accessing relevant documents
Portal users should not automatically receive the same backend access as employees.
Public Users
Public users interact with publicly available website functionality without logging into the backend.
For example:
Website visitors
eCommerce visitors
Public forms
It is important not to confuse public website access with internal ERP access.
Odoo Access Rights: Read, Write, Create and Delete
One of the most important concepts in Odoo security is the four basic model permissions.
Read
The user can view records.
Example:
A salesperson can view customers.
Write
The user can modify existing records.
Example:
A sales manager can edit customer information.
Create
The user can create new records.
Example:
A salesperson can create a new lead.
Delete
The user can delete records.
This permission should generally be granted carefully.
Deleting records can have significant operational consequences, particularly in systems containing:
Sales orders
Invoices
Purchase orders
Inventory transactions
Manufacturing records
Employee information
In many implementations, users should be able to create and modify records but not delete them.
Why Delete Permissions Need Extra Attention
Giving everyone delete access is one of the common Odoo security mistakes.
Consider a sales team.
A salesperson may accidentally delete an important quotation.
A warehouse employee could accidentally delete a record needed for operational tracking.
An administrator could remove something that another department depends on.
Instead, organizations can often design workflows where users can:
Create → Edit → Cancel → Archive
without giving them unrestricted deletion permissions. This improves traceability and reduces accidental data loss. The exact approach depends on the Odoo application and business process.
Odoo Record Rules Explained
Record rules become particularly important when a company needs more granular control. Suppose a company has:
Salesperson A
Salesperson B
Sales Manager
You may want:
Salesperson A
→ sees their own opportunities and quotations.
Salesperson B
→ sees their own opportunities and quotations.
Sales Manager
→ sees opportunities and quotations belonging to the entire sales team.
All three users may have access to the Sales model, but they do not necessarily need access to the same records. Record rules can help implement this kind of structure.
Sales Team Access
Imagine a Pakistani distribution company with three sales teams:
The organization may want salespeople to access only customers and opportunities assigned to their team.
The sales manager may need access to all three teams.
A regional director may need access to all sales records.
Instead of giving everyone unrestricted access, Odoo can be configured around these business rules. This provides better data segregation while allowing management to maintain visibility.
Multi-Company Access Rights
Multi-company Odoo implementations require additional planning.
For example, a group may operate:
A user working for Company A should not necessarily have unrestricted access to Company B and Company C. When configuring multi-company environments, consider:
- Allowed companies
- Default company
- Accounting access
- Sales access
- Inventory access
- Warehouses
- Journals
- Products
- Customers
- Reports
- Intercompany transactions
A poorly designed multi-company configuration can create confusion and expose information across legal entities. Before implementing multi-company access, we recommend documenting exactly which employees need access to each company.
Odoo Administrator Access
Administrator permissions should be limited. An administrator can potentially change critical configuration, security settings and business processes. For this reason, you should avoid giving administrator privileges simply because someone needs to perform a normal operational task.
For example:
- A sales manager does not normally need technical administration rights just because they need to manage sales teams.
- An accountant does not necessarily need system configuration rights simply because they manage financial processes.
- An HR manager may need extensive HR access without needing unrestricted access to every Odoo application.
A small number of trusted administrators is generally easier to manage and audit.
Odoo Access Rights for Accounting
Accounting deserves special attention because financial information is highly sensitive.Consider separating:
Accounting Users
Can:
Manage invoices
Process bills
View accounting information
Perform assigned accounting tasks
Accounting Managers
Can:
Review financial transactions
Manage accounting configuration
Review reports
Perform higher-level financial operations
Other Employees
May need:
No accounting access
Limited invoice visibility
Access to documents relevant to their work
The exact permissions depend on the company's financial processes and Odoo configuration.
For Pakistani businesses, accounting permissions may also need to align with internal controls, management reporting and local operational requirements.
Odoo Access Rights for HR
Employee information should also be carefully protected.HR data may contain:
Employee records
Contracts
Attendance
Time off
Payroll information
Personal information
Performance information
Not every employee should have access to all HR data.
For example:
Employee
→ can access their own relevant employee information.
HR Officer
→ can manage employee records.
HR Manager
→ can manage broader HR processes.
Payroll Manager
→ may require access to payroll-specific information.
The goal should be to separate operational access from sensitive HR information wherever practical.
Odoo Inventory Permissions
Warehouse permissions should reflect actual warehouse responsibilities. For example:
Warehouse User
May:
Process receipts
Process deliveries
Perform inventory operations
View stock
Inventory Manager
May additionally:
Configure warehouses
Manage routes
Adjust inventory
Configure replenishment
Manage advanced inventory settings
Giving every warehouse employee administrator-level inventory access is usually unnecessary.
Odoo Manufacturing Permissions
Manufacturing businesses often need multiple levels of access.For example:
Production User
→ works with manufacturing orders.
Production Manager
→ manages planning and production operations.
Manufacturing Administrator
→ configures manufacturing settings.
You might also need different permissions for:
- Bills of materials
Work centers
Quality
Maintenance
Inventory
Purchase
Planning
A manufacturing ERP therefore benefits from a permissions structure designed around the production process.
Odoo Access Rights and Approvals
Access rights can also support approval workflows. For example:
A salesperson can create a quotation.
A sales manager approves a discount above a certain threshold.
A finance manager approves a financial transaction.
An administrator manages configuration.
This separates responsibilities and reduces the risk of one person controlling an entire process.
Access rights should therefore be considered alongside:
Approval rules
Automated actions
Workflows
Record rules
Notifications
Reporting
A secure ERP is not simply about restricting access. It is about designing controlled business processes.
Odoo Studio and Access Rights
One of the useful features of Odoo is Odoo Studio, which allows businesses to make many customizations without traditional programming. OdooPakistan uses Studio where it is appropriate for the requirement. For example, Studio can be useful for:
Adding custom fields
Modifying forms
Changing list views
Adding approval steps
Creating simple automations
Customizing reports
Adjusting workflows
Improving user interfaces
Our Odoo customization services in Pakistan follow a simple principle:
Use standard Odoo where possible, Studio where appropriate, and custom development when the requirement genuinely needs it.
Studio is powerful, but it should not be treated as the answer to every customization requirement.
How We Help Click Theory Customize Odoo
A good example of this approach is our collaboration with Click Theory, an Odoo partner serving businesses that need connected ERP, eCommerce and operational systems. Click Theory's business model combines eCommerce, ERP and digital solutions for physical businesses. Its website describes Odoo ERP development and integration as part of its service offering. When working with an Odoo partner such as Click Theory, the objective is not simply to "change Odoo." The objective is to create a system that fits the customer's business.
For example, a customer may need a new template for:
Quotations
Sales orders
Invoices
Delivery documents
Purchase orders
Internal documents
Customer communications
Instead of immediately developing a completely custom module, we first determine whether the requirement can be handled through standard Odoo configuration or Studio.
Designing a New Odoo Template using odoo studio
Suppose a Click Theory customer needs a customized quotation.The standard Odoo quotation may not contain everything the business wants.The customer may require:
Company branding
Custom header
Additional customer information
Salesperson details
Product specifications
Payment terms
Delivery information
Custom footer
Additional fields
Business-specific disclaimers
We can first analyze the existing Odoo report and determine which parts can be changed using configuration or Studio. Where appropriate, we can then design a new template that better reflects the customer's business. The objective is not to make the document complicated.
It is to make it clear, professional and useful.
Changing Templates When the Business Changes
Businesses evolve. A company may initially need one quotation template and later introduce new product categories, sales teams, payment terms, legal information, branding or approval requirements
The Odoo environment should therefore be designed so that future changes can be managed efficiently.Studio can be particularly useful for controlled changes that do not justify full custom development.However, if the requirement involves complex business logic, integrations, advanced reporting or functionality that must be maintained across Odoo upgrades, custom development may be a better choice.
This is why our approach is not:
"Use Studio for everything."
Instead, it is:
"Use the right Odoo customization method for the requirement." Odoo Studio vs Custom Development A practical decision framework looks like this:
| Requirement | Recommended approach |
|---|---|
| Add a simple field | Studio |
| Modify a form view | Studio |
| Change a list view | Studio |
| Add a simple automation | Studio |
| Modify a basic report | Studio |
| Complex business logic | Custom development |
| Advanced integration | Custom development |
| External API | Custom development |
| Complex security logic | Configuration + development where required |
| Large reusable feature | Custom module |
| Upgrade-sensitive customization | Carefully designed development |
This approach helps control technical debt. A business should not create a custom module for something that can safely be achieved with standard Odoo functionality. At the same time, a business should not force Studio to perform a task for which proper development is required.
Case Reference: Practical Odoo Integration Experience
Our wider Odoo consulting work also includes projects where business requirements extend beyond standard ERP configuration. One example documented through ShahidMalik.io is the DATEV–Odoo integration guide, which demonstrates the type of accounting and integration challenges that can arise when Odoo needs to work with external financial systems. The work highlights the importance of understanding business requirements, accounting structures, data formats and integration requirements rather than treating ERP configuration as a purely technical exercise. This is relevant to user and access-right design because ERP security should be considered as part of the entire business process.
A successful Odoo implementation therefore connects process design, user roles, security, configuration and technical architecture.
A Practical Odoo Security Model for Pakistani Businesses
For many small and medium-sized businesses in Pakistan, we recommend starting with a simple role-based model.
Level 1 — Operational Users
These users perform daily tasks.
Examples:
Sales executives
Purchase officers
Warehouse employees
Production users
Customer service employees
Their permissions should be limited to their operational responsibilities.
Level 2 — Department Managers
Managers need broader visibility.
They may need to:
Review team records
Approve transactions
View reports
Manage team workflows
Correct operational issues
However, they still may not need technical administrator rights.
Level 3 — Functional Managers
These users may manage application configuration.
Examples:
Finance manager
Inventory manager
HR manager
Manufacturing manager
Sales manager
They need deeper access within their specific application.
Level 4 — System Administrators
System administrators manage:
Users
Security groups
Configuration
Technical settings
Applications
System-wide functionality
These permissions should be limited to trusted personnel.
Common Odoo Access Rights Mistakes
Mistake 1: Giving Everyone Administrator Access
This is one of the most common shortcuts.
It may make configuration easier initially, but it creates long-term security and governance problems.
Mistake 2: Configuring Users Without Understanding Their Roles
Creating users first and thinking about permissions later can result in inconsistent access. Start with the organizational structure.
Mistake 3: Ignoring Record Rules
Access rights alone may not provide the required level of control.If salespeople should only see their own records, record rules may be necessary.
Mistake 4: Giving Delete Access Unnecessarily
Most operational users do not need unrestricted deletion rights.Consider whether archiving, cancellation or controlled correction is more appropriate.
Mistake 5: Forgetting Former Employees
When an employee leaves the organization, their access should be reviewed immediately.
An inactive employee should not continue to have access to the ERP.
Mistake 6: Not Reviewing Access After Promotions
An employee promoted from salesperson to sales manager may need additional permissions. Their old permissions should also be reviewed.
Mistake 7: Creating Too Many Custom Groups
Security configuration can become difficult to maintain if dozens of overlapping groups are created without a clear structure. Keep roles understandable.
Mistake 8: Changing Security Directly in Production
Security changes should ideally be tested before being applied to a live environment. A small configuration change can unexpectedly affect multiple users.
Testing Odoo Access Rights
Testing is essential. Before going live, create test scenarios for each major role.
For example:
Salesperson Test
Can the user:
Create a quotation?
Edit a quotation?
Confirm an order?
See another salesperson's quotation?
Access accounting information?
Delete a record?
Warehouse User Test
Can the user:
Process a receipt?
Process a delivery?
View stock?
Change product configuration?
Access accounting?
Accountant Test
Can the user:
Create invoices?
Register payments?
View accounting reports?
Access inventory configuration?
Modify system settings?
Administrator Test
Can the administrator:
Create users?
Change permissions?
Configure applications?
Manage system settings?
Testing these scenarios helps identify security problems before users encounter them in production.
Access Rights Should Be Documented
Security configuration should not exist only inside someone's memory. Maintain documentation containing:
User roles
Security groups
Application permissions
Special access
Record rules
Approval permissions
Administrator accounts
Exceptions
Business reasons for special access
This becomes particularly important when:
Employees leave
New employees join
The company grows
An Odoo partner changes
The database is migrated
The Odoo version is upgraded
Documentation also makes troubleshooting much easier.
Odoo User Management During Implementation
User management should be part of the implementation plan, not something completed 5 minutes before go-live.
At OdooPakistan, our implementation approach includes understanding:
Business requirements
Organizational structure
User roles
Application requirements
Approval processes
Access restrictions
Reporting requirements
Training needs
Testing
Go-live procedures
Our Odoo implementation services are designed around business processes rather than simply installing applications.
Odoo Training for Administrators and Key Users
Even a perfectly configured security model can become ineffective if administrators do not understand how it works.We provide Odoo training in Pakistan covering areas such as:
User management
Access rights
Odoo configuration
Workflows
Odoo Studio
Application administration
Functional processes
Reporting
Troubleshooting
We can also train internal key users so that businesses do not have to depend on an external consultant for every small configuration change.
Odoo Access Rights During Migration
User permissions also need attention during an Odoo migration.When migrating from:
Odoo 15 to Odoo 16
Odoo 16 to Odoo 17
Odoo 17 to Odoo 18
Odoo 18 to Odoo 19
Odoo 19 to Odoo 20
Another ERP to Odoo
the security structure should be reviewed.
A migration is an opportunity to remove obsolete users, review old groups and redesign permissions.
Instead of blindly transferring every old permission, ask:
Does this user still need this access?
This can significantly improve the security of the new environment.
Learn more about our Odoo migration services in Pakistan.
Odoo Access Rights and Ongoing Support
Security is not a one-time configuration.Businesses change continuously. Employees often join, leave, change departments,get promoted or change responsibilities. Business processes also change. New applications may be installed. New companies may be added.
New integrations may be introduced. For this reason, Odoo access rights should be reviewed periodically.
Our Odoo support and maintenance services can help businesses manage ongoing changes, troubleshooting, configuration and customization.
How OdooPakistan Helps Businesses in Pakistan
OdooPakistan provides Pakistan-focused Odoo services including:
Our approach combines functional consulting with technical expertise.
We don't simply ask:
"Which Odoo module do you want?"
We ask:
"How does your business work, who performs each process, what information do they need, and what should they be allowed to change?"
That difference is important. Odoo is a flexible ERP, but flexibility needs structure.
OdooPakistan, Mediod Consulting and ShahidMalik.io
OdooPakistan is the Pakistan-focused sister company of Mediod Consulting, an Odoo consulting and technology business serving customers across Pakistan and international markets. The wider team brings experience across implementation, development, integrations, migration, customization and ERP consulting.
OdooPakistan also collaborates with ShahidMalik.io on Odoo consulting, technical problem solving and business-focused ERP projects.
This wider collaboration allows us to combine:
Local Pakistan focus
Odoo implementation expertise
Technical development
Business process consulting
International project experience
The result is an Odoo service model designed to help businesses build ERP systems that can grow with them.
Frequently Asked Questions About Odoo Users & Access Rights
What are Odoo access rights?
Odoo access rights determine what users can do with particular models or applications. Common permissions include reading, creating, editing and deleting records.
What is the difference between Odoo access rights and record rules?
Access rights determine what a user can generally do with a model. Record rules can provide more granular control over which records the user can access.
Should every Odoo user be an administrator?
No. Most employees should receive only the permissions required for their job.
Can Odoo restrict users to their own records?
Yes. Depending on the application and configuration, record rules and security groups can be used to restrict access to particular records.
Can Odoo Studio be used to customize user access?
Studio can help with many aspects of Odoo customization, but complex security requirements may require deeper configuration or custom development.
Can Odoo access rights be customized for Pakistani businesses?
Yes. Odoo can be configured around the organizational structure and business processes of Pakistani companies.
Can OdooPakistan configure user permissions?
Yes. OdooPakistan provides Odoo implementation, configuration, customization, training and support services for businesses in Pakistan.
Can you customize Odoo templates using Studio?
Yes. Where appropriate, Studio can be used to modify fields, views, reports and other supported elements. For more advanced requirements, professional Odoo development may be more appropriate.
Can you help an existing Odoo customer?
Yes. OdooPakistan can help businesses that already have Odoo installed and need configuration, customization, migration, integration, troubleshooting, training or ongoing support.
Final Checklist: Odoo User & Access Rights
- Before going live, review the following:
Every employee has an appropriate Odoo user account.
Former employees have been deactivated.
Each user has the correct security groups.
Users do not have unnecessary administrator privileges.
Accounting access is restricted appropriately.
HR information is protected.
Warehouse permissions match job responsibilities.
Sales permissions match organizational structure.
Record rules have been tested.
Delete permissions have been reviewed.
Multi-company access has been tested if applicable.
Approval workflows have been tested.
Administrator accounts are documented.
Security configuration is documented.
User access has been tested with real-world scenarios.
Changes have been tested before production deployment.
Users have received appropriate training.
A process exists for reviewing access when employees change roles.
Conclusion
- Odoo users and access rights are much more than a technical configuration screen. They define how people interact with your ERP. A salesperson should have the tools required to sell. Warehouse employee should have the tools required to manage stock.An accountant should have the tools required to manage financial operations. An HR manager should have access to the information required to manage employees.A manager should have the visibility required to make decisions and an administrator should have the authority required to maintain the system without unnecessarily giving every employee unrestricted access.
For Pakistani businesses implementing Odoo, the best approach is to design permissions around real business roles, processes and responsibilities.
Odoo Studio can then help with many practical customizations, including fields, views, reports and workflows, while professional development can be used when requirements become more complex.
Our work with Odoo partners such as Click Theory demonstrates the same principle: understand the business requirement first, determine whether standard Odoo or Studio can solve it, and develop a maintainable solution when additional functionality is genuinely required.
If your organization is implementing Odoo, migrating from another ERP, redesigning its existing Odoo environment, or struggling with user permissions, OdooPakistan can help.
Need help configuring Odoo users, access rights or business workflows in Pakistan?
Talk to an Odoo Expert at OdooPakistan
You can also explore our Odoo Guides for practical resources on Odoo configuration, implementation, customization, migration and business processes.
Related Odoo Resources
OdooPakistan — Practical Odoo Consulting, Implementation, Customization & Support for Businesses in Pakistan.
