Odoo gives you groups, ACLs and record rules, and they work — until the day someone has to prove who narrowed what, when, and who approved it. Access changes in a live Odoo database are edits: a group gets a new line in ir.model.access.csv, a record rule is widened for one urgent request, a user is added to a set of groups nobody documented. There is no submitted-and-approved revision to point at, no independent approver, no way to put the previous state back exactly, and no way to demonstrate to an auditor that the access history has not been edited after the fact.

Ecosire Access Management is the governance layer for that problem, and it is deliberately built so it can never make your Odoo less safe. Every existing ACL and record-rule denial stays authoritative. Ecosire policies are deny-only: they can remove access a user already has, and they can never grant access Odoo would refuse. That single constraint is what makes the module safe to install on a production database — the worst a misconfigured policy can do is deny too much, which the before-and-after comparison shows you before activation and the one-step rollback undoes.

Around that core sit the controls a governed environment actually needs. A policy version becomes immutable the moment it is submitted, and it carries its validation evidence with it. The person who wrote it cannot be the person who approves it. Activation writes a receipt. Rollback restores the exact prior state, not an approximation of it. Governed role bundles carry request-time expiry so temporary access really is temporary. Company-scoped separation-of-duties packs block conflicting role submissions outright, or require an attributable, digest-bound risk acceptance from a named person. Joiner/mover/leaver events are independently approved and touch only the governed roles they declare — unrelated native groups are preserved, which is the failure mode that turns a routine leaver process into a broken user account.

Field-level exposure is handled by typed masking on supported read, export and standard QWeb report paths, so a salary or a national ID does not leave the server in a spreadsheet just because someone had list access. Lockout is handled too: a reason-bound break-glass session requires two distinct designated native Odoo system administrators to confirm, lasts no more than an hour, and bypasses only Ecosire overlay denials — never a native Odoo permission. Audit events are verifiable at the application level, so mutation of the history is detectable rather than assumed away.

The module is honest about its boundaries, and they are documented rather than buried. Method and button enforcement covers Odoo web dataset calls; XML-RPC, JSON-2 and direct server-side ORM calls are explicitly not claimed. Audit verification detects application-level event mutation and is not presented as protection against a database administrator. Recovery administrators must be genuine base.group_system users in addition to being designated here. You are buying a governed overlay with a stated perimeter, not a marketing claim.

It installs on Odoo 19 Community or Enterprise against base, web and mail only — no external Python package, no remote service, no phone-home. Licensed OPL-1, one payment per Odoo version, with the full source in your hands.