Odoo 20 replaces two security layers with one. In Odoo 19, an access right said which groups could read, write, create or delete a model, and a separate record rule limited which records. In Odoo 20, a single access right holds the model, the group, the operations and an optional domain that filters records. User groups themselves don't change. For a standard database the upgrade does the conversion. The real work is in custom modules and in record rules someone added by hand.
What changed in Odoo 20 access rights
The release notes put it in one sentence: "Access rights have been simplified by removing record rules and adding a domain directly at the access right level to determine which records the access right applies to." The ORM changelog shows this landed first on Odoo Online in version 19.4, as "ir.access that merges ACLs and record rules". If you are on Odoo Online and already moved past 19.0, you may be running it already.
| Odoo 19 | Odoo 20 | |
|---|---|---|
| Technical models | Access rights (ir.model.access) plus record rules (ir.rule) | One model, ir.access |
| Operations | Four checkboxes: read, write, create, delete | An operation field holding a subset of "crud", such as r or cud |
| Which records | The record rule's domain | The access right's own domain |
| An entry with no group | Access right: granted to every user. Record rule: a global restriction. | A restriction applied to every user (a "global rule") |
| Module data file | ir.model.access.csv | ir.access.csv with columns id, name, model_id, group_id/id, operation, domain |
One row in that table needs attention. In Odoo 19, an access line with no group gave access to everyone. In Odoo 20, an access right with no group restricts everyone. The 20.0 tutorial says to grant something to every user through the base.group_everyone group, and adds that this is "a bit risky" because, depending on the apps installed, "it may grant even non-users access to the model".
What stays the same
- Groups. A user still belongs to groups, a group can still imply other groups, and a group is still tied to an app through its privilege. Your Sales, Inventory and Accounting groups carry over as they are.
- The user form. Roles, the Access Rights tab with a level per app, and the Technical Access Rights tab in developer mode are described the same way in the 19.0 and 20.0 user documentation.
- Additive rights. A user's access is still the union of what all their groups grant.
- Field-level groups. A field can still be limited to certain groups, and is then removed from views for everyone else.
- Default deny. If no access right covers a model and operation for a user, they have no access.
How Odoo 20 combines access rights
The combination logic will be familiar from Odoo 19's record rules. It now applies to access rights:
- Group rights unify. A user can act on a record if any access right in any of their groups covers that model and operation, and the record matches that right's domain.
- Global rights intersect. A record must satisfy every access right that has no group. Each one you add narrows access further.
- Global beats group. A global right can block access that a group right would otherwise grant.
- No domain means all records. The tutorial warns that a right without a domain allows the operation on every record of the model, which "can have odd effects" if rights are too permissive.
The developer reference also warns that creating several global rules is risky, because rules that don't overlap can remove all access.
In Odoo 20, one access right with no domain, in any of a user's groups, opens every record of that model to that user.
Mapping Odoo 19 groups and rules onto Odoo 20
Odoo's upgrade service converts standard modules. What you need to check is anything your own team, a partner or Studio users added. A practical way to inventory and map it:
- List what you have in Odoo 19. In developer mode, go to Settings › Users & Companies › Groups. For each group your company relies on, note its Access Rights and Record Rules tabs. Also export your custom modules'
ir.model.access.csvfiles and any record rules they define in XML. - Access with no rule. An Odoo 19 access line for a group, with no record rule for that group on that model, becomes an Odoo 20 access right with the same group and operations and no domain.
- Access plus a group rule. Fold the rule's domain into the access right. Rules often differed by operation, so split them. The 20.0 tutorial does exactly this: a read right with no domain so every employee can see records, and a
cudright with a domain so only the assigned user can change them. - Global record rules. A rule with no group, such as a multi-company rule, becomes an access right with no group. It is a restriction on everyone, as before.
- Access lines with no group. In Odoo 19 these granted access to all users. In Odoo 20 the same empty group would restrict instead, so give each one a real group. Use
base.group_everyoneonly if you accept the risk the tutorial describes. - Users in several groups. Check these users most carefully. Odoo 19 rules weren't additive with access lines, while Odoo 20 makes every access right in every group count on its own. Read literally, the two references suggest that a user who had full model access from one group and a record rule from another could end up seeing more in Odoo 20 than before. Test it with real logins.
- Test as each role. On the upgraded test database, log in as a typical user of each role, not as an administrator, and try to see and edit what they shouldn't.
Other permission changes in Odoo 20 apps
Beyond the framework change, the release notes and 20.0 documentation list app-level changes that affect who can do what:
| Where | Change |
|---|---|
| Users | A new Light role for staff with limited needs: personal HR items, leave and expenses, Planning, POS sessions as an employee, reading Knowledge and barcode scanning. The documentation says a Light user is "automatically upgraded to a User role" if granted access beyond those defaults, which changes the licence. |
| Barcode | Light users can be restricted to the Barcode module only. |
| Time Off | A new "No" user right blocks access to the app. |
| Attendances | Users without Attendances access rights can no longer use the app. |
| Point of Sale | Employee access levels are renamed, and a new, highly restrictive "Supervised" level is added. |
| Documents | Groups of users can be defined to manage access to files and folders. |
| Spreadsheet | Template visibility and access can be limited to user groups. |
| Employees | In a multi-company database, all users can now see the employees of all companies. |
Look at the last row carefully if you run separate companies in one database and treated employee lists as private between them. Check it on your test database before go-live.
Who does the work
Odoo's upgrade SLA covers standard applications, Studio customisations while Studio is installed and the subscription is active, and code under a maintenance-of-customisations subscription. Custom modules written in-house or by a partner aren't covered. Their maintainer has to rewrite the security files for ir.access. That's usually a small job per module, but it touches every module that defines access, so put it in the estimate. The broader process is in our guide to upgrading from Odoo 19 to 20, and the Odoo 19 starting point is in companies, users and access rights in Odoo 19.
Questions we get asked
Does Odoo 20 still have record rules?
No. The Odoo 20 release notes say record rules have been removed and a domain has been added directly to the access right, to decide which records it applies to. Technically, Odoo 19's access rights and record rules are merged into one model, ir.access, holding a model, a group, the allowed operations and an optional domain. Groups still exist and work as before.
Will my Odoo 19 user groups work in Odoo 20?
Your groups carry over: users still belong to groups, groups still imply other groups, and the per-app access levels on the user form still apply. What changes is the security attached to them. Odoo's upgrade handles standard modules, but custom modules with their own access files or record rules must be rewritten for the new ir.access model by their maintainer.
What does an access right with no group mean in Odoo 20?
In Odoo 20, an access right with no group is a restriction applied to every user, called a global rule. Its domain must be satisfied for anyone to access a record. That is the reverse of Odoo 19, where an access line with no group granted the model to every user. Odoo suggests the base.group_everyone group to grant something to all, with care.
How should I test access rights after upgrading to Odoo 20?
On an upgraded test database, log in as a real user from each role, never as an administrator or in superuser mode. For each role, try to open, edit and delete records it should and should not reach. Give particular attention to users who belong to several groups, to multi-company setups, and to any custom module that defined its own record rules in Odoo 19.