Access Explorer

The dangerous permission is the one nobody thought to check

Checking access user by user only finds what you already suspected. It cannot find the access rule someone left without a group on it, which quietly grants every user in the database. It cannot tell you which of your models nothing narrows, so that access to the model is access to every row. And it will not tell you who can delete accounting entries until you think to ask about that particular person and that particular model.

This sweeps every user against every model that matters and tells you what stood out.

A review across users and sensitive models: what each can do, which grants reach everyone, and which are narrowed by no record rule at all.

Grants that reach everyone

An access rule with no group on it applies to every user in the database. It is the most common accidental over-grant in Odoo and the hardest to notice, because checking any single user shows nothing unusual - they are supposed to have it. The review flags every one of them by name.

Access with no row filter

A grant that no record rule narrows means access to the model is access to every record in it. That is often correct and occasionally alarming, and you cannot tell which without being shown where it happens.

Resolved, not listed

Permissions are computed as each user, through the same calls Odoo uses to enforce them - so implied groups, global rules and group rules are already combined. You are reading a conclusion, not three tables to cross-reference.

The superuser is left out on purpose

It bypasses every rule by design, so including it would report full access to everything and bury the findings that matter. It is excluded even if you select it.