Role & Group Access Designer

Role & Group Access Designer is a made-to-order Odoo module that ECOSIRE builds on base and web to add a role abstraction layer on top of res.groups. We introduce a res.role model whose many2many bundles the exact security groups that define a business function — 'Warehouse Lead', 'AP Clerk', 'Sales Manager' — and a compute method (@api.depends on the role's group set) that recomputes each assigned user's effective groups_id automatically, so ir.model.access and record rules stay clean and derived rather than hand-maintained. The build includes a bulk user-to-group matrix view (OWL/JS client action over a server-side read) with multi-select, filtering, and inline toggles; a clone-access action that copies every group from a source user onto one or many targets in a single call; and an implied-groups visualizer that walks the inheritance graph so an admin sees the full effective permission set behind any user or role, not just the boxes they ticked.

Beyond the core, we build the operational guardrails that make access governance auditable. Time-bound roles carry optional start/end dates and an ir.cron scheduled action that auto-revokes expired temporary access; a diff view compares two users' or two roles' group membership side by side; and an orphan/over-privileged detector flags anyone sitting in base.group_system or technical groups, or holding no role at all. Every grant is written to a full assignment audit trail (who assigned which role to whom, and when), and a role-template library with export/import — serialized as XML data or pushed via the JSON-RPC/XML-RPC API — lets you deploy the same role set across staging, production, and multiple databases. In multi-company environments, role assignment is company-scoped so a user's function can differ per company. Everything is delivered in both Community and Enterprise flavors and targets Odoo 17.0, 18.0, and 19.0.

Because this is build-to-order, we start with a short scoping call to map your existing groups, job functions, and multi-company topology, then confirm a fixed scope and quote before writing a line of code. We build against your target Odoo version, deliver on a staging database for UAT, and only cut over to production once you have signed off — typical delivery is 2 to 4 weeks from confirmed scope. You receive the full source, git repo handover, and a defined post-go-live support window. Pricing starts from $299 (indicative, single-company base scope); multi-company role scoping, heavier group inheritance graphs, cross-database template syncing, and integration with an external IdP or SSO provisioning flow increase the quoted scope.