Access Security in Odoo — ir.model.access.csv and Record Rules (Odoo 16–19)

id,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink

# Internal users — read + write + create, no delete
access_project_task_user,access_project_task_user,model_project_task,base.group_user,1,1,1,0

# Managers — full CRUD
access_project_task_manager,access_project_task_manager,model_project_task,project.group_project_manager,1,1,1,1

# Portal users — read only
access_project_task_portal,access_project_task_portal,model_project_task,base.group_portal,1,0,0,0

{
    'name': 'My Module',
    'depends': ['base'],
    'data': [
        # Security files must come BEFORE views in the data list
        # so that groups are defined before views reference them.
        'security/groups.xml',           # custom group definitions
        'security/ir.model.access.csv',  # model-level ACL
        'security/record_rules.xml',     # record rules (ir.rule)
        # Views and other data come after:
        'views/my_model_views.xml',
    ],
}

<?xml version="1.0" encoding="utf-8"?>
<odoo>
    <!-- Define a module-specific group category -->
    <record id="module_category_my_module" model="ir.module.category">
        <field name="name">My Module</field>
        <field name="sequence">100</field>
    </record>

    <!-- User group — basic access -->
    <record id="group_my_module_user" model="res.groups">
        <field name="name">User</field>
        <field name="category_id" ref="module_category_my_module"/>
        <field name="implied_ids" eval="[(4, ref('base.group_user'))]"/>
    </record>

    <!-- Manager group — inherits user group, adds extra rights -->
    <record id="group_my_module_manager" model="res.groups">
        <field name="name">Manager</field>
        <field name="category_id" ref="module_category_my_module"/>
        <field name="implied_ids" eval="[(4, ref('group_my_module_user'))]"/>
        <field name="users" eval="[(4, ref('base.user_admin'))]"/>
    </record>
</odoo>

<?xml version="1.0" encoding="utf-8"?>
<odoo>

  <!-- Pattern 1: Own-records rule
       Users can only read/write records they created.
       Global rule — applies to all users. -->
  <record id="rule_my_model_own_records" model="ir.rule">
    <field name="name">My Model: Own Records Only</field>
    <field name="model_id" ref="model_my_module_my_model"/>
    <field name="domain_force">[('create_uid', '=', user.id)]</field>
    <!-- No groups → global rule, applies to everyone -->
  </record>

  <!-- Pattern 2: Manager bypass
       Managers can see ALL records (overrides the own-records rule above
       for members of the manager group via OR logic). -->
  <record id="rule_my_model_manager_all" model="ir.rule">
    <field name="name">My Model: Manager Sees All</field>
    <field name="model_id" ref="model_my_module_my_model"/>
    <field name="domain_force">[(1, '=', 1)]</field>
    <field name="groups" eval="[(4, ref('my_module.group_my_module_manager'))]"/>
  </record>

  <!-- Pattern 3: Multi-company isolation
       Global rule — users can only see records of their own company.
       Combining allowed_company_ids ensures multi-company switching works. -->
  <record id="rule_my_model_company" model="ir.rule">
    <field name="name">My Model: Company Isolation</field>
    <field name="model_id" ref="model_my_module_my_model"/>
    <field name="domain_force">
      ['|',
        ('company_id', '=', False),
        ('company_id', 'in', company_ids)]
    </field>
    <!-- Global rule — no groups field -->
  </record>

</odoo>