Every growing Odoo deployment eventually hits the same wall: the native permission model is coarser than the business needs. Odoo controls access through ir.model.access.csv (create/read/write/unlink per group per model) plus ir.rule record rules, but out of the box you cannot cleanly say "this group may read the customer record but never see the credit limit field," or "salespeople may edit their own draft quotations yet only read confirmed ones," or "warehouse leads see stock moves for their own warehouse and nothing else." Teams end up cloning groups endlessly, hand-editing dozens of CSV lines, and layering domain-based record rules that are hard to audit and easy to break on the next upgrade. The result is either over-permissioned users (a compliance and data-leak risk) or a brittle web of custom groups nobody fully understands.

This is a build-to-order module that ECOSIRE designs and engineers to your actual roles. We model your access matrix as first-class configuration: a permission-profile layer sitting on top of res.groups, with per-model CRUD, field-level read/write masking, menu and action visibility, and dynamic record rules generated from your criteria (owner, sales team, company, warehouse, region, or document state). Field masking is enforced on the server, not merely hidden in the view — we combine view groups= attributes with fields_get filtering and read/write guards on models.Model, so a restricted field cannot be exfiltrated or written through the ORM, a custom XML-RPC/JSON-RPC client, or an exported action. Every profile change is captured in an audit log so you can prove who could see what, and when.

Technically, the module ships as a proper addon with its own __manifest__.py, declaring dependencies only on the apps you actually restrict. Permission profiles are stored models with @api.depends compute chains that materialise into concrete ir.model.access and ir.rule records, so the resulting security stays native and upgrade-safe rather than living in a runtime monkey-patch. Configuration is driven from clean OWL/XML backend views (an access matrix editor, per-field toggles, and a "simulate as role" preview), and where policy touches printed output we can gate QWeb report fields and add automated actions that flag or block privilege escalations. It is built and tested for Odoo 17.0, 18.0, and 19.0, and we account for Community vs Enterprise differences up front — some approval and audit-trail primitives exist only in Enterprise, so we confirm your edition during scoping and implement the equivalent cleanly where you are on Community.

Delivery is build-to-order, not an instant download. After a short scoping call we map your roles into an access matrix, agree the exact rules, and give you a fixed quote. We then build on a branch, deliver to a staging database for UAT, and only promote to production once you sign off — with a rollback plan in hand. Typical delivery is 2–4 weeks from confirmed scope, depending on how many roles and edge-case rules you need. Pricing starts from $249 (indicative, single-company base scope); multi-company access separation, a larger number of role profiles, and deep field-level masking across many models increase the quoted scope.