Record rules
Odoo record rules are row-level access rules that limit which records a user can see or act on inside Odoo. They are an important part of Odoo security.
What they are
A record rule narrows access at the row level. For example, it lets a salesperson see only their own orders, or limits records to a user's company. Odoo enforces these rules in its application layer.
How STYD relates to them
With an Odoo API key
Odoo runs every read as the key's user, so Odoo applies that user's access rights and record rules. STYD also keeps to its own list of areas and companies.
Odoo runs every read as the key's user, so Odoo applies that user's access rights and record rules. STYD also keeps to its own list of areas and companies.
With the STYD Bridge
STYD does not reproduce record rules. The module reads with its own access, and STYD limits each member to the areas their Odoo groups give (Accounting, Sales, Purchase, Inventory) and to their companies. A rule such as “see only your own orders” is not applied.
STYD does not reproduce record rules. The module reads with its own access, and STYD limits each member to the areas their Odoo groups give (Accounting, Sales, Purchase, Inventory) and to their companies. A rule such as “see only your own orders” is not applied.
Treat row-level enforcement as something to keep tight in Odoo. Do not rely on STYD to recreate it. STYD does not read Odoo's access rules (
ir.rule) on a Bridge or API-key connection, so it cannot list or explain them.How to stay safe
Keep Odoo access rights and record rules clean and current.
Use a dedicated Odoo user with only the rights STYD needs. With an API key that is the key's user. With the Bridge, it is the user who generates the token: its companies set the outer limit.
On a Bridge connection, map workspace members to Odoo users so each member gets their own areas and companies.
For sensitive data, do not depend on STYD alone to enforce row-level rules. If rows must stay hidden from some people, use an API key for a user that Odoo already limits, or keep that data out of the connection.