Access Snapshot

"Can this person see that?" takes twenty minutes to answer

The answer lives in three places that have to be combined by hand: the access rules for the model, every group the user is in including the ones implied by other groups, and the record rules that filter which rows they get. Odoo shows you those three things separately and leaves the combining to you.

This does the combining. Pick a user and a model, and get the answer Odoo itself would give.

One user against one model: what they can do, which groups granted it, and the row filter that applies.

Global rules cannot be group-hopped

Record rules with no group are global: they combine with AND, and adding a user to another group cannot get past them. Rules that do carry groups combine with OR, so each extra group only ever widens what the user sees. Getting that backwards is how permissions end up wrong, so the result says which kind is in play.

It refuses to answer about the superuser

The superuser bypasses every access rule and record rule by design, so a report on it would say "allowed" for everything no matter how your database is configured. That is a confident wrong answer about security, so the app declines instead of producing it.