Access Groups, Record Rules & Security

Quickenerp Security Model

Quickenerp uses a layered security model with three levels:

1. Access Groups (Roles) – What modules/models a user can access.
2. Record Rules – Which records within a model a user can see/edit.
3. Field Security – Which fields on a form a user can see/edit.

1. Access Groups (ir.model.access)

Access groups define the basic permission level for each model. They control:

• Read – Can the user see records?
• Write – Can the user edit records?
• Create – Can the user create new records?
• Unlink (Delete) – Can the user delete records?

Navigate: Settings > Technical > Security > Access Controls (developer mode).

Each line defines permissions for a specific model-group combination. For example, the "Sales / User" group has read+write+create access on sale.order but not "unlink" (delete). The "Sales / Manager" group has all four permissions including unlink.

2. Record Rules (ir.rule)

Record rules further restrict which records a group can access. They work like filters applied automatically:

Navigate: Settings > Technical > Security > Record Rules.

Rules use domain syntax (a filter expression). Example for "Own Documents":
[('user_id', '=', user.id)]

3. Field Security (Groups on Fields)

Individual fields can be restricted to specific groups. For example:

• "Cost Price" field on products – visible only to Inventory Manager group.
• "Margin" field on sales orders – visible only to Sales Manager group.
• "Bank Account" field – visible only to Accounting group.

Field security is configured in the view definition (XML) using Developer Mode.

Managing Security Groups

Navigate: Settings > Technical > Security > Groups.

Each group has:

• Name – The group name (e.g. "User", "Manager").
• Application – The module it belongs to.
• Category – Groups can be organised into categories (e.g. "Sales", "Accounting").
• Inherited Groups – Groups that automatically get the same permissions. For example, "Manager" inherits "User" so managers have user-level permissions plus extra.
• Users – The list of users in this group.

Security Best Practices

• Principle of Least Privilege – Give users only the minimum permissions needed for their job.
• Use Record Rules, Not Custom Groups – Instead of creating a custom group for every access pattern, use record rules to filter within existing groups.
• Regular Audits – Review user permissions quarterly. Archive accounts of departed employees immediately.
• Portal Users – Use portal access for external users (customers, vendors). They see only their own documents through the portal, not the backend.
• Multi-Company Security – In multi-company setups, users see only data from their allowed companies. Record rules automatically filter by company.