Odoo's web client saves aggressively by design: a dirty form is auto-committed when the user clicks away via the breadcrumb, opens a related record, presses a smart button, or discards the view. For high-stakes records — draft invoices, manufacturing orders, priced sales lines, HR data, inventory adjustments — that helpful behavior becomes a liability. Users commit half-finished edits without meaning to, @api.onchange side effects fire prematurely, and audit trails fill with unintended writes. Odoo core gives you no setting to disable this: the auto-save is baked into the OWL form controller and the standard breadcrumb/discard flow, and record rules or ir.model.access.csv only govern whether a write is allowed, never when it happens. That is exactly where native runs out of road.

Auto Save Restrict is a module we build to your specification that intercepts the form view's implicit save path and requires an explicit user action before any commit is persisted. Technically, we patch the web client form controller (the OWL FormController in 17.0+) so that navigation away, smart-button clicks, and view discards no longer silently flush a dirty record; instead the user gets a deliberate "Save / Discard / Stay" decision, or — where you prefer — the toolbar Save button becomes the only route to a write. Scope is configured per model through a small settings model (res.config.settings toggles plus a target-model allowlist), so you decide which models are restricted (for example account.move and mrp.production) and which keep Odoo's default behavior. Because the gate is client-side interception layered over the standard ORM create/write, no data path is bypassed — security, record rules, and constraints all still apply on the actual save.

Under the hood the module ships as a standard addon: a __manifest__.py declaring the web and relevant business dependencies, a JS asset bundle that extends the form controller and (optionally) the list-view inline-edit save, an ir.model.access.csv for the configuration model, and an optional res.groups so that only users in a "Confirm before save" group are affected — letting you exempt power users if desired. Behavior can be driven by an automated action or server-side ir.config_parameter where you want a headless default. It is engineered against the framework's public patch points rather than brittle template overrides, so it survives point upgrades, and we build and test it explicitly for Odoo 17.0, 18.0, and 19.0 on both Community and Enterprise (Enterprise-only views such as certain accounting and studio-generated forms are handled where present in your edition).

Delivery is build-to-order: after a short scoping call we confirm the exact models, user groups, and confirmation UX, then build, test on a staging copy of your database, and install on your environment — typical delivery is 2–4 weeks from confirmed scope. You receive the full source, documentation, and a support window; nothing is a pre-existing download you install yourself. Pricing starts from $249 (indicative, single-company base scope); the number of restricted models, custom confirmation workflows, per-group exemption logic, and multi-company or Enterprise-view coverage increases the quoted scope.