How to create Record rules in Odoo 19

Think about running a company where you've got all this sensitive data moving around. You want to be sure only the right people can get to it, right? That's where Odoo 19's record rules come in handy. They're like the hidden tool that lets you control who can see, change, or delete stuff. Whether it's keeping customer info safe or making team work smoother, knowing how to use record rules is super important. It helps you follow the rules, be efficient, and not worry so much. In this guide, we'll show you how to make these rules, step by step, with a real example. Ready to make Odoo even better? Let's do it!

What Record Rules Do in Odoo

Before we start, let's explain record rules. In Odoo, record rules (in the ir.rule model) are like filters that limit who can access records based on their user rights. They work with access rights to keep things safe. For example, you can let users change only the records they made or were given.

Record rules are usually set up in XML files inside your custom modules. This makes sure they're used the same way everywhere. In Odoo 19, it's like older versions, but it might work better for big sets of data. But the main way to write them is still the same.

Step-by-Step: Creating a Record Rule

To make a record rule, just write it as an XML record in your module's data files (like in security/ir.model.access.csv, or in its own XML file). Here’s an example taken from Odoo, made for the mail.activity model. This rule lets users write or delete activities, but only if they’re the ones who created them or are assigned to them.

<record id="mail_activity_rule_user" model="ir.rule">
   <field name="name">mail.activity: user: write/unlink only (created or assigned)</field>
   <field name="model_id" ref="model_mail_activity"/>
   <field name="domain_force">['|', ('user_id', '=', user.id), ('create_uid', '=', user.id)]</field>
   <field name="groups" eval="[Command.link(ref('base.group_user'))]"/>
   <field name="perm_create" eval="False"/>
   <field name="perm_read" eval="False"/>
   <field name="perm_write" eval="True"/>
   <field name="perm_unlink" eval="True"/>
</record>

This XML snippet creates a new rule. Let's break it down by defining each attribute (or field) in detail:

• id: This is the unique identifier for the record rule, like "mail_activity_rule_user". It must be unique within the module and is used for references or upgrades. Think of it as the rule's fingerprint in the database.
• model: Set to "ir.rule", this specifies that we're creating a record in the ir.rule model, which is Odoo's built-in model for defining access rules.
• name: A human-readable label, such as "mail.activity: user: write/unlink only (created or assigned)". This helps administrators identify the rule in the backend interface under Settings > Technical > Security > Record Rules.
• model_id: References the target model where the rule applies, using ref="model_mail_activity". Here, it points to the mail.activity model (activities like tasks or reminders). The ref attribute looks up the ID of the ir.model record for that model.
• domain_force: This is the core of the rule – a domain expression that filters records. In this case, ['|', ('user_id', '=', user.id), ('create_uid', '=', user.id)] means: allow access if the activity is assigned to the current user (user_id = user.id) OR if the user created it (create_uid = user.id). Domains use Odoo's standard syntax: lists of tuples for conditions, with operators like '| ' for OR and '&' for AND.
• groups: Defines which user groups this rule applies to, using eval="[Command.link(ref('base.group_user'))]". This links to the "Internal User" group (base.group_user). The Command.link is an Odoo ORM command to add a many-to-many relation. You can apply rules globally (no groups) or to specific ones.
• perm_create: A boolean (eval="False") indicating if this rule grants create permission. Here, it's False, meaning this rule doesn't allow creating new records – that's handled by access rights.
• perm_read: Boolean (eval="False"), controls read access. Set to False, so this rule doesn't grant reading; users might read via other rules or global access.
• perm_write: Boolean (eval="True"), allows editing (write) for matching records.
• perm_unlink: Boolean (eval="True"), permits deletion (unlink) for matching records.

Once the module is installed you can view the created record rule, go to Settings > technical > Security > Record Rules

Below in the list view, you can see the created rule.