Most Odoo dashboard tools solve the wrong half of the problem. They give a builder a blank canvas and a way to write SQL or a Python expression, and the result is a board that is fast to make and impossible to trust: nobody knows whether the number is defined the way finance defines it, whether the person looking at it was allowed to see the underlying records, or who changed the definition last Tuesday. The dangerous failure is not a broken chart. It is a chart that is confidently wrong, or one that shows a user rows their record rules were supposed to hide.

Ecosire Dashboard Management inverts that. An administrator allowlists the business metrics and actions that exist — the semantic layer — and nothing outside that allowlist can appear on a board. Managers assemble versioned boards from those approved semantics. An independent reviewer, not the author, approves and activates the immutable revision, which carries a definition checksum so a published board and its definition cannot silently drift apart. The result is a dashboard you can put in front of an auditor, a board member, or a customer without a caveat.

Access is not re-implemented, which is the point. Semantic queries execute as the requesting user, so model access, field access and record rules are enforced by Odoo itself before any value leaves the server. Audience, company and drill-through actions are checked server-side. There is no service account quietly reading everything and filtering in the browser — the pattern that turns a dashboard into a data leak.

Charts and filters are typed. A filter bar narrows only the semantics it is explicitly compatible with, and the browser cannot submit a raw domain or a widening operator, so a curious user with developer tools cannot broaden their own view. Governed snapshots capture bounded aggregates together with the user, company, revision, filter set, locale, classification, checksum, expiry and legal-hold context that make a saved number meaningful six months later. Threshold alerts deduplicate until they reset and re-cross, so an alert channel stays worth reading; exceptions are assigned and resolved through audited dialogs. Scheduled delivery generates each recipient payload separately under that recipient user and company context, so a subscription cannot become a side channel around access rules. CSV export neutralises formula-leading cells, and print, PDF and narrative flows reuse the authorised payload rather than re-querying with different privileges.

The exclusions are deliberate and worth reading, because they are what makes the guarantees hold. No raw SQL. No Python or executable expressions. No runtime plugins, public iframes, remote data sources, CDN assets or arbitrary actions. The eight launch packs that ship are capability-aware declarative drafts containing no invented business metrics — an administrator binds approved local semantic definitions before activation, and an application that is not installed produces an explicit unavailable state instead of a fabricated number. There is no visual drag-and-drop designer. If a drag-and-drop canvas that can run SQL is what you want, this is the wrong module and we would rather say so here.

Presentation is treated as a first-class requirement: explicit loading, empty, populated, unavailable and recoverable-error states, with keyboard navigation, screen-reader support, mobile layout, dark mode, RTL and reduced-motion handling. Fifteen typed server contracts back the client. It installs on Odoo 19 Community or Enterprise against base, web and mail only — no external Python package and no remote service. Licensed OPL-1, one payment per Odoo version, full source included.