Odoo ships with a capable security model — groups, ir.model.access.csv for CRUD at the model level, and record rules for row-level scoping — but most teams hit a wall the moment they need finer control. You cannot, out of the box, hide a specific button on a form for one department, blank out a sensitive field like a salary or cost price for a role, remove a single menu item without touching the group that grants the underlying access, or block a QWeb report from being printed by users who can still see the record. Admins end up cloning groups, hand-editing XML, and maintaining brittle overrides that break on every upgrade. Access intent lives in a dozen places, and nobody can answer "who can actually do what" without opening the database.

All In One Access Management is a productized module we build for you that consolidates access control into one administrator screen. From a single configuration model you restrict, per user or per security group, the pieces of the interface that Odoo's native tools leave exposed: top-level and nested menu items, individual fields (read-only or fully hidden), header and statusbar buttons, notebook tabs, list/form/kanban views, and QWeb report actions. Rules are additive and evaluated at render time, so a person in three groups gets the correct union of restrictions without you cloning a single group.

Technically, the module defines its own configuration models (models.Model) with a clean __manifest__.py declaring dependencies and data files, and enforces rules by extending the relevant _fields_view_get / view-arch pipeline for fields, tabs, buttons and views, layering ir.ui.menu visibility on top of Odoo's menu computation, and gating ir.actions.report execution for report locking. Sensitive-field hiding is applied server-side in the view architecture — not just CSS — so values are not shipped to the browser and cannot be read via the developer tools or the XML-RPC/JSON-RPC API by an unauthorized user. Access decisions are cached per user/group and invalidated on rule change to keep form rendering fast. Everything respects the existing ir.model.access.csv and record-rule layer rather than replacing it, and we keep an audit-friendly configuration so you can export exactly who is restricted from what. We support Odoo 17.0, 18.0, and 19.0, and adapt to Community or Enterprise (some Enterprise-only views and studio-generated fields need specific handling, which we cover during scoping).

Because this is build-to-order, nothing is auto-installed to your database on purchase. We start with a short scoping call to map your groups, the exact menus/fields/buttons/reports you want governed, and your Community-vs-Enterprise setup and edition. We then build against your version, deliver on a staging database for UAT, and go live only after you sign off — typical delivery is one working week from confirmed scope. You receive the installable source, documentation, and a support window. Pricing starts from $999 (indicative, single-company base scope); wider rule matrices, multi-company access segregation, and integration with custom or third-party modules increase the quoted scope.