Smart Access Manager FAQs

These frequently asked questions cover the most common questions about configuring and using Smart Access Manager. For the full feature list, see Smart Access Manager Features.

Getting Started

Which Odoo editions are supported?

Fully compatible with Odoo Enterprise (On-premise and Odoo.SH) and Odoo Community. Not compatible with Odoo Online (SaaS) — that hosting tier does not allow third-party apps.

Do I need any other app installed?

No. Smart Access Manager depends only on standard Odoo components. Every rule points at a record type that already exists in your database, so it works with whichever apps you use.

Who is allowed to set this app up?

Your Odoo administrator, plus anyone you give the Smart Access Manager / Manager group to — that group can build roles, assign them, and approve access requests without being a full Odoo administrator. Security Officer adds the compliance, conflict, and audit screens on top, and every administrator holding Settings receives it automatically.

Will installing it change anyone's access?

No. Nothing changes until you create your first role. Smart Access Manager only adds restrictions on top of your existing Odoo access rights.

Can I try a role on one person before rolling it out?

Yes. Create the role, assign it to a single test user, and log in as them. Nobody else is affected until the role is assigned, and removing the assignment puts that user back exactly as they were. A role can also be left Archived while you build it, or a record filter kept switched off with Apply Filter until you have reviewed it.

Does it replace Odoo's access rights and record rules?

No, it works alongside them. Odoo decides what a user is allowed to do; Smart Access Manager narrows it further. Because it only restricts, a role can never give someone access they did not already have.

What happens if I uninstall it?

All roles, rules, grants, and logs created by the app are removed, and every user returns to their standard Odoo access rights.

Roles & Assignment

What is the difference between Assigned Users and Apply to Groups?

Assigned Users targets specific people. Apply to Groups targets everyone in the chosen Odoo groups, including members who hold the group indirectly — so anyone added to the group later receives the role automatically. Both can be used on the same role.

Can one user hold several roles?

Yes. Field rules resolve to the most restrictive setting, record filters combine, and any role that hides an element hides it. Record permissions are the exception: an operation is allowed if any role allows it.

How do I give access that ends by itself?

Use Access Control ‣ Granted Role Access and set an Expires On date. The role stops applying as soon as the date passes, and the user receives a reminder e-mail beforehand.

Does it work with more than one company?

Yes. A role’s Companies field limits it to the companies you choose, and the role follows the company the user is currently working in. Leave the field empty and the role applies in every company. Two roles may share a name as long as their company scope differs, which is how the same policy is rolled out company by company.

Restrictions

Is a hidden field really hidden, or just hidden on screen?

Really hidden. The value is removed from the data itself, so it is also empty over the external API, cannot be exported, and cannot be grouped or aggregated.

Can users bypass a restriction by exporting or using the API?

No. Blocked export closes the export routes themselves; blocked import, duplicate, and archive are refused by the server; and locked or required fields are enforced on save, whichever way the save was made.

Can I apply a restriction only on the list view and not the form?

Yes. Field rules and value filters have an Apply on which screens? option. Leave it empty to apply everywhere, or pick specific screens.

What is the difference between Domain Access and Filter Field Values?

Domain Access controls which records a user can work with. Filter Field Values controls which records appear in a dropdown, without restricting the records themselves.

Can a restriction depend on the record's status?

Yes — that is what Conditional Rules do. Build a condition such as Status = Posted, then choose whether to lock the record, lock certain fields, block deletion, or hide elements.

Users & Administrators

Why can I not restrict an administrator?

Administrators are deliberately protected from lock-out: Block Login, the Kill Switch, Global Read-Only, and Block External API never apply to a user holding Settings or Access Rights. Remove those rights first, then apply the role.

What is the difference between Block Login and the Kill Switch?

Block Login is a role setting: users assigned to that role cannot authenticate. The Kill Switch is an immediate action on one user: it revokes their roles, blocks re-login, and logs them out of every open session within about a second. Both keep all data intact, and both are reversible.

Compliance

Are conflicting permissions between roles blocked?

No. Permission conflicts are informational — one role deliberately overriding another is a normal pattern. The role form shows the clash and which permission applies, so you can decide.

How do I produce evidence for an auditor?

Use Compliance & Risk ‣ Compliance ‣ Audit Reports, choose a report type and a period, and click Generate Now. A monthly audit pack is also produced automatically each month.