Row-Level Security and Dynamic Record Rules

1. Overview & Business Value#

This comprehensive operational guide details the architecture, business workflows, configuration parameters, and execution steps for Row-Level Security and Dynamic Record Rules within SmartERP.

While model ACLs control whether a user can access a table, Record Rules (ir.rule) inject dynamic SQL WHERE clauses controlling exactly which rows a user can view or modify.

Record Rule Domain Example#

<record id="rule_sales_personal_leads" model="ir.rule">
    <field name="name">Salesperson: Own Leads Only</field>
    <field name="model_id" ref="model_crm_lead"/>
    <field name="domain_force">[('user_id', '=', user.id)]</field>
    <field name="groups" eval="[(4, ref('sales_team.group_sale_salesman'))]"/>
</record>

{screenshot:row-level-security-and-record-rules-overview-dashboard}

2. Prerequisites & Security Access Groups#

• Required Modules: base, web, smarterp_security
• Security Groups:
  • Enterprise Security Officer (Technical ID: base.group_user)
  • Security Administrator (Technical ID: base.group_system)
• Master Data Dependencies: Established security group hierarchy, defined multi-company boundaries, and configured access control lists (ir.model.access.csv).

3. Step-by-Step Configuration & Execution#

Step 1: Navigating to the Module Interface#

1. Log into your SmartERP instance at https://smarterp.et/odoo.
2. Open the main App Switcher (grid icon in the top-left corner).
3. Select the Settings app icon.
4. From the top navigation bar, open Users & Companies → Users / Groups / Record Rules.

{screenshot:row-level-security-and-record-rules-app-switcher-navigation}

Step 2: Creating and Parameterizing Records#

1. Click the New button in the top-left control panel.
2. Complete the mandatory fields in the security form:
   • Rule Name (Mandatory): Descriptive identifier for security rule.
   • Target Model (Mandatory): Underlying data model subject to access control.
   • Domain Filter (Mandatory): Logical Python domain expression enforcing row-level restriction.
3. Configure optional parameters: group assignment, global rule flags, and active state.

{screenshot:row-level-security-and-record-rules-record-creation-form}

Step 3: Validating and Processing Transactions#

• Execution & Validation: Switch user context to test persona and verify query behavior.
• Log Verification: Confirm that restricted records are omitted from list and search views.

{screenshot:row-level-security-and-record-rules-transaction-processing-state}

4. Advanced Configuration Points#

• Automated Actions & Scheduled Tasks (Crons):
  • Security: Audit log archival (base.ir_cron_audit_archive)
  • Security: Expire dormant sessions (base.ir_cron_session_expire)
• Custom Print Templates & Reports:
  • Role-Based Access Control (RBAC) Security Matrix
  • System Security & User Activity Audit Dossier
• Multi-Company Rules: Record-level security isolation under Company 1 (Ashewa Technology Solutions S.C.).

5. Comprehensive Troubleshooting Matrix#