Odoo security works, but configuring it is a developer job. To restrict a field, hide a smart button, or narrow which records a group can see, you normally hand-edit ir.model.access.csv, write ir.rule domains, and patch view arch with groups= attributes or attrs — all in XML and Python, redeployed through a module upgrade. Functional admins can set model-level CRUD and toggle group membership from Settings, but everything finer than that (per-field visibility, per-button access, own-records-only rules, hiding a specific sub-menu) requires touching source. That gap is where SMB teams either over-provision access they shouldn't, or wait on a developer for every small change.

Granular Access Manager closes that gap with a UI-driven designer built on top of base and web. A permission matrix renders every model against every group so you can set create/read/write/unlink on ir.model.access with a click and see the resulting effective rights live. A visual ir.rule builder lets you compose record domains from a field/operator/value picker — "own records only" ([('user_id','=',uid)]), "own team", or "own company" — without hand-writing a domain or worrying about global vs groups evaluation. Field-level visibility and read-only rules are applied through computed security groups layered onto the view arch at render time, so you never edit or fork the original views. Menus and sub-menus are hidden from a tree of the full menu hierarchy; header buttons, smart buttons, and object/action buttons are hidden or disabled per group; and you can restrict which window actions, server actions, and QWeb reports a group is allowed to launch. Export, archive, duplicate, and Delete privileges are governed independently of raw unlink rights.

Everything you configure is written back as standard Odoo security records — ir.model.access, ir.rule, groups, and view extensions — so your access model survives module upgrades and is exportable as a clean data module. A Preview-as-user mode lets you impersonate a group and see exactly which menus, fields, and buttons that group will get before you save. A change diff log records every access modification with author, timestamp, and a before/after snapshot; any change reverts in one click, and full profiles export and import as XML. A conflict detector flags contradictory rules — for example one group granting read where a rule denies it — before they reach production.

Because this is a build-to-order product, ECOSIRE builds it for your database rather than shipping a generic download. After a short scoping call we confirm your Odoo edition (Community or Enterprise), target version (17.0, 18.0, or 19.0), the models and groups in scope, and any custom modules whose views and access need to be covered. We build against your actual model set, install and configure on a staging database, run UAT with your team, then deploy to production with a rollback plan and hand over the git repository. Typical delivery is one working week from confirmed scope. Pricing starts from $999 (indicative, single-company base scope); broader coverage — multi-company record-rule isolation, large numbers of custom models, or deeper localization of access profiles — increases the quoted scope.