Security, confidentiality, and access governance

1. Overview & Business Value#

This comprehensive operational guide details the architecture, business workflows, configuration parameters, and execution steps for Security, confidentiality, and access governance within SmartERP.

Enterprise correspondence frequently carries sensitive commercial information, classified state correspondence, executive personnel decisions, or legal disputes. SmartERP Letter & Correspondence Management implements multi-tier role-based access control (RBAC), confidentiality clearances, departmental record rules, and audit logging to protect organizational privacy.

{screenshot:security-and-confidentiality-overview-dashboard}

2. Prerequisites & Security Access Groups#

• Required Modules: smarterp_letter, smarterp_correspondence
• Security Groups:
  • Letter Registry Clerk (Technical ID: smarterp_letter.group_letter_clerk)
  • Executive Reviewer (Technical ID: smarterp_letter.group_letter_reviewer)
  • Director General (Technical ID: smarterp_letter.group_letter_executive)
• Master Data Dependencies: Dual calendar templates (Ethiopian & Gregorian), official stamp repository, letter reference numbering formats, and departmental dispatch routes.

3. Step-by-Step Configuration & Execution#

Step 1: Navigating to the Module Interface#

1. Log into your SmartERP instance at https://smarterp.et/odoo.
2. Open the main App Switcher (grid icon in the top-left corner).
3. Select the Correspondence app icon.
4. From the top navigation bar, open Correspondence → Letters → Inbound / Outbound / Internal Memoranda.

{screenshot:security-and-confidentiality-app-switcher-navigation}

Step 2: Creating and Parameterizing Records#

1. Click the New button in the top-left control panel.
2. Complete the mandatory fields in the record form:
   • Letter Subject (Mandatory): Clear administrative or commercial subject heading
   • Sender / Recipient Entity (Mandatory): External institution or internal department
   • Dispatch Channel (Mandatory): Physical courier, hand delivery, or digital dispatch
   • Dual Date (EC & GC) (Mandatory): Official Ethiopian calendar and Gregorian dates
3. Configure optional operational parameters and localized tags as required:
   • Digital Signature / Seal (Optional): Authorized executive cryptographic stamp
   • Security Classification (Optional): Routine, Confidential, Secret, or Top Secret
   • Related Prior Reference (Optional): Cross-referenced correspondence tracking ID
4. Click the Save icon in the control bar to commit the record.

{screenshot:security-and-confidentiality-record-creation-form}

Step 3: Validating and Processing Transactions#

• State Transitions: Execute operational state progression (Draft Memo → Editorial Review → Legal Clearance → Executive Signature & Stamp → Dispatched / Archived).
• Ledger & System Impact: Maintains immutable institutional correspondence registry with cryptographic QR validation for external party verification.
• Audit Verification: Automated recording of author ID, timestamp, and immutable revision history.

{screenshot:security-and-confidentiality-transaction-processing-state}

Security user groups#

SmartERP Letters defines fine-grained security groups structured across operational responsibilities:

Confidentiality levels and record rules#

Every correspondence record is assigned a confidentiality level that strictly restricts database queries via Odoo Record Rules:

flowchart TD
    PUB[Public: Visible to all internal users and circular portal]
    INT[Internal: Visible to originating department members and recipients]
    CONF[Confidential: Requires 'Confidential Clearance' group OR explicit assignment]
    SEC[Secret / Restricted: Requires 'Secret Clearance' AND explicit assignment]
    
    PUB --> INT
    INT --> CONF
    CONF --> SEC

Access Matrix by Confidentiality Level#

Statutory retention schedules and legal holds#

1. Statutory Retention Policies: Letters can be bound to automated retention policies (e.g., Financial correspondence: 10 years; Routine circulars: 3 years; Board resolutions: Permanent). When retention expires, letters are marked for archival review.
2. Legal Holds: When litigation or regulatory audits occur, authorized compliance officers can place an official Legal Hold on a letter thread. While on legal hold:
   • The letter cannot be archived, soft-deleted, or purged.
   • Any attempt to alter underlying DMS attachments raises an immediate security block.
   • All access events are recorded in high-fidelity compliance logs.

4. Advanced Configuration Points#

• Automated Actions & Scheduled Tasks (Crons):
  • Letters: Check dispatch delivery receipt status (smarterp_letter.ir_cron_dispatch_check): Runs daily to verify courier delivery confirmation slips
  • Letters: Follow-up on pending memorandum actions (smarterp_letter.ir_cron_followup): Runs weekly to alert assigned officers of pending correspondence replies
• Custom Print Templates & Reports:
  • Official Letterhead Dispatch Copy with QR Verification
  • Institutional Letter Inward/Outward Registry Ledger
• Multi-Company Rules: Record-level security isolation under Company 1 (Ashewa Technology Solutions S.C.), preventing cross-company ledger leakage across parent and subsidiary legal entities.

5. Comprehensive Troubleshooting Matrix#