Odoo's permission system is powerful. It's also one of the hardest parts of the platform to debug. Two overlapping layers — model-level ACLs and record-level rules — interact in ways that are nearly invisible. This module makes them visible.

The Problem Every Odoo Developer Knows

A user reports they can't open a record. You check their groups — they look correct. You check the access rights for the model — they look correct. You check the record rules — something is off, but you're not sure which rule is blocking access or why.

The usual approach: trial and error in the developer console, adding debug logging, or temporarily granting wider access to narrow things down. It works, but it's slow — and in production, it's risky.

These two outcomes — same user, same model, different records — are exactly what the Security Visualizer is designed to explain clearly, without reading through Python domain expressions by hand.

What the Module Does

The Access Matrix — A Practical Example

The matrix view gives you a cross-reference of users and models. Here's a simplified version of what it looks like in practice:

This is the kind of view that would normally require navigating through Settings → Technical → Security → Access Rights, cross-referencing multiple tables manually. The matrix collapses that into one screen.

Technical Details

For those who want to understand what's actually under the hood:

security_visualizer/
  ├── models/
  │   └── security_visualizer.py   # Core logic: ACL + rule evaluation
  ├── static/src/
  │   ├── js/
  │   │   ├── rule_explainer.js    # OWL component — analyzer view
  │   │   └── access_matrix.js    # OWL component — matrix view
  │   └── xml/
  │       └── templates.xml
  ├── views/
  │   └── security_visualizer_views.xml
  ├── tests/                       # 15 unit tests
  │   ├── test_acl.py
  │   ├── test_rules.py
  │   ├── test_simulation.py
  │   └── test_matrix.py
  └── security/
      └── ir.model.access.csv     # Restricted to base.group_system

The frontend is built with Odoo's native OWL framework, reusing built-in components — AutoComplete, TagsList, useService("orm") — with only about 126 lines of custom CSS to handle layout features that Odoo's design system doesn't cover (sticky headers, collapsible sections). No custom colors: everything is standard Bootstrap utility classes.

The OCA Review Process

The PR has been open since February 2026 and is actively under review by OCA maintainers. This is how open source works — serious modules get serious scrutiny, and that's a good thing.

Reviewer feedback so far has been constructive and substantive. The main themes:

Feedback also led to concrete improvements already merged into the PR: native OWL component reuse, adherence to Odoo's design system, filter state preservation between tabs, and cleaner CRUD operation handling. The review process has made the module better.

Why This Matters for Odoo Teams

Odoo's security model is genuinely complex. ir.model.access operates at the model level — a blunt instrument that applies to all records of a type. ir.rule operates at the record level — a fine-grained filter using domain expressions that evaluate differently for each record and each user.

When both layers are in play, diagnosing access issues means reasoning about both simultaneously. That's hard to do mentally, especially in multi-company deployments where rules can vary by company context.

The Security Visualizer doesn't replace understanding — it amplifies it. You still need to know how Odoo's security system works. But now you have a tool that shows you exactly what it's doing for a specific user, on a specific model, for a specific record, in real time.