[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CV4BAA76R9VT6R9KTQ3P3B":3,"skill-same:01M6CV4BAA76R9VT6R9KTQ3P3B":58},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":40,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M6CV4BAA76R9VT6R9KTQ3P3B","odoo-security-rules",null,"Expert in Odoo access control: ir.model.access.csv, record rules (ir.rule), groups, and multi-company security patterns.","Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fodoo-security-rules\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30],"security","Rules","odoo","odoo security rules","safe","csv","access","model","expert","patterns","record","self","2026-11-10 10:12:30",false,"---\nname: odoo-security-rules\ndescription: \"Expert in Odoo access control: ir.model.access.csv, record rules (ir.rule), groups, and multi-company security patterns.\"\nrisk: safe\nsource: \"self\"\n---\n\n# Odoo Security Rules\n\n## Overview\n\nSecurity in Odoo is managed at two levels: **model-level access** (who can read\u002Fwrite which models) and **record-level rules** (which records a user can see). This skill helps you write correct `ir.model.access.csv` entries and `ir.rule` domain-based record rules.\n\n## When to Use This Skill\n\n- Setting up access rights for a new custom module.\n- Restricting records so users only see their own data or their company's data.\n- Debugging \"Access Denied\" or \"You are not allowed to access\" errors.\n- Implementing multi-company record visibility rules.\n\n## How It Works\n\n1. **Activate**: Mention `@odoo-security-rules` and describe the access scenario.\n2. **Generate**: Get correct CSV access lines and XML record rules.\n3. **Debug**: Paste an access error and get a diagnosis with the fix.\n\n## Examples\n\n### Example 1: ir.model.access.csv\n\n```csv\nid,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink\naccess_hospital_patient_user,hospital.patient.user,model_hospital_patient,base.group_user,1,0,0,0\naccess_hospital_patient_manager,hospital.patient.manager,model_hospital_patient,base.group_erp_manager,1,1,1,1\n```\n\n> **Note:** Use `base.group_erp_manager` for ERP managers, not `base.group_system` — that group is reserved for Odoo's technical superusers. Always create a custom group for module-specific manager roles:\n>\n> ```xml\n> \u003Crecord id=\"group_hospital_manager\" model=\"res.groups\">\n>     \u003Cfield name=\"name\">Hospital Manager\u003C\u002Ffield>\n>     \u003Cfield name=\"category_id\" ref=\"base.module_category_hidden\"\u002F>\n> \u003C\u002Frecord>\n> ```\n\n### Example 2: Record Rule — Users See Only Their Own Records\n\n```xml\n\u003Crecord id=\"rule_hospital_patient_own\" model=\"ir.rule\">\n    \u003Cfield name=\"name\">Hospital Patient: Own Records Only\u003C\u002Ffield>\n    \u003Cfield name=\"model_id\" ref=\"model_hospital_patient\"\u002F>\n    \u003Cfield name=\"domain_force\">[('create_uid', '=', user.id)]\u003C\u002Ffield>\n    \u003Cfield name=\"groups\" eval=\"[(4, ref('base.group_user'))]\"\u002F>\n    \u003Cfield name=\"perm_read\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_write\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_create\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_unlink\" eval=\"False\"\u002F>\n\u003C\u002Frecord>\n```\n\n> **Important:** If you omit `\u003Cfield name=\"groups\">`, the rule becomes **global** and applies to ALL users, including admins. Always assign a group unless you explicitly intend a global restriction.\n\n### Example 3: Multi-Company Record Rule\n\n```xml\n\u003Crecord id=\"rule_hospital_patient_company\" model=\"ir.rule\">\n    \u003Cfield name=\"name\">Hospital Patient: Multi-Company\u003C\u002Ffield>\n    \u003Cfield name=\"model_id\" ref=\"model_hospital_patient\"\u002F>\n    \u003Cfield name=\"domain_force\">\n        ['|', ('company_id', '=', False),\n               ('company_id', 'in', company_ids)]\n    \u003C\u002Ffield>\n    \u003Cfield name=\"groups\" eval=\"[(4, ref('base.group_user'))]\"\u002F>\n\u003C\u002Frecord>\n```\n\n## Best Practices\n\n- ✅ **Do:** Start with the most restrictive access and open up as needed.\n- ✅ **Do:** Use `company_ids` (plural) in multi-company rules — it includes all companies the user belongs to.\n- ✅ **Do:** Test rules using a non-admin user in debug mode — `sudo()` bypasses all record rules entirely.\n- ✅ **Do:** Create dedicated security groups per module rather than reusing core Odoo groups.\n- ❌ **Don't:** Give `perm_unlink = 1` to regular users unless deletion is explicitly required by the business process.\n- ❌ **Don't:** Leave `group_id` blank in `ir.model.access.csv` unless you intend to grant public (unauthenticated) access.\n- ❌ **Don't:** Use `base.group_system` for module managers — that grants full technical access including server configurations.\n\n## Limitations\n\n- Does not cover **field-level access control** (`ir.model.fields` read\u002Fwrite restrictions) — those require custom OWL or Python overrides.\n- **Portal and public user** access rules have additional nuances not fully covered here; test carefully with `base.group_portal`.\n- Record rules are **bypassed by `sudo()`** — any code running in superuser context ignores all `ir.rule` entries.\n- Does not cover **row-level security via PostgreSQL** (RLS) — Odoo manages all security at the ORM layer.\n","# Odoo Security Rules\n\n## Overview\n\nSecurity in Odoo is managed at two levels: **model-level access** (who can read\u002Fwrite which models) and **record-level rules** (which records a user can see). This skill helps you write correct `ir.model.access.csv` entries and `ir.rule` domain-based record rules.\n\n## When to Use This Skill\n\n- Setting up access rights for a new custom module.\n- Restricting records so users only see their own data or their company's data.\n- Debugging \"Access Denied\" or \"You are not allowed to access\" errors.\n- Implementing multi-company record visibility rules.\n\n## How It Works\n\n1. **Activate**: Mention `@odoo-security-rules` and describe the access scenario.\n2. **Generate**: Get correct CSV access lines and XML record rules.\n3. **Debug**: Paste an access error and get a diagnosis with the fix.\n\n## Examples\n\n### Example 1: ir.model.access.csv\n\n```csv\nid,name,model_id:id,group_id:id,perm_read,perm_write,perm_create,perm_unlink\naccess_hospital_patient_user,hospital.patient.user,model_hospital_patient,base.group_user,1,0,0,0\naccess_hospital_patient_manager,hospital.patient.manager,model_hospital_patient,base.group_erp_manager,1,1,1,1\n```\n\n> **Note:** Use `base.group_erp_manager` for ERP managers, not `base.group_system` — that group is reserved for Odoo's technical superusers. Always create a custom group for module-specific manager roles:\n>\n> ```xml\n> \u003Crecord id=\"group_hospital_manager\" model=\"res.groups\">\n>     \u003Cfield name=\"name\">Hospital Manager\u003C\u002Ffield>\n>     \u003Cfield name=\"category_id\" ref=\"base.module_category_hidden\"\u002F>\n> \u003C\u002Frecord>\n> ```\n\n### Example 2: Record Rule — Users See Only Their Own Records\n\n```xml\n\u003Crecord id=\"rule_hospital_patient_own\" model=\"ir.rule\">\n    \u003Cfield name=\"name\">Hospital Patient: Own Records Only\u003C\u002Ffield>\n    \u003Cfield name=\"model_id\" ref=\"model_hospital_patient\"\u002F>\n    \u003Cfield name=\"domain_force\">[('create_uid', '=', user.id)]\u003C\u002Ffield>\n    \u003Cfield name=\"groups\" eval=\"[(4, ref('base.group_user'))]\"\u002F>\n    \u003Cfield name=\"perm_read\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_write\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_create\" eval=\"True\"\u002F>\n    \u003Cfield name=\"perm_unlink\" eval=\"False\"\u002F>\n\u003C\u002Frecord>\n```\n\n> **Important:** If you omit `\u003Cfield name=\"groups\">`, the rule becomes **global** and applies to ALL users, including admins. Always assign a group unless you explicitly intend a global restriction.\n\n### Example 3: Multi-Company Record Rule\n\n```xml\n\u003Crecord id=\"rule_hospital_patient_company\" model=\"ir.rule\">\n    \u003Cfield name=\"name\">Hospital Patient: Multi-Company\u003C\u002Ffield>\n    \u003Cfield name=\"model_id\" ref=\"model_hospital_patient\"\u002F>\n    \u003Cfield name=\"domain_force\">\n        ['|', ('company_id', '=', False),\n               ('company_id', 'in', company_ids)]\n    \u003C\u002Ffield>\n    \u003Cfield name=\"groups\" eval=\"[(4, ref('base.group_user'))]\"\u002F>\n\u003C\u002Frecord>\n```\n\n## Best Practices\n\n- ✅ **Do:** Start with the most restrictive access and open up as needed.\n- ✅ **Do:** Use `company_ids` (plural) in multi-company rules — it includes all companies the user belongs to.\n- ✅ **Do:** Test rules using a non-admin user in debug mode — `sudo()` bypasses all record rules entirely.\n- ✅ **Do:** Create dedicated security groups per module rather than reusing core Odoo groups.\n- ❌ **Don't:** Give `perm_unlink = 1` to regular users unless deletion is explicitly required by the business process.\n- ❌ **Don't:** Leave `group_id` blank in `ir.model.access.csv` unless you intend to grant public (unauthenticated) access.\n- ❌ **Don't:** Use `base.group_system` for module managers — that grants full technical access including server configurations.\n\n## Limitations\n\n- Does not cover **field-level access control** (`ir.model.fields` read\u002Fwrite restrictions) — those require custom OWL or Python overrides.\n- **Portal and public user** access rules have additional nuances not fully covered here; test carefully with `base.group_portal`.\n- Record rules are **bypassed by `sudo()`** — any code running in superuser context ignores all `ir.rule` entries.\n- Does not cover **row-level security via PostgreSQL** (RLS) — Odoo manages all security at the ORM layer.\n",{"name":5,"risk":23,"source":30,"description":7},"main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fodoo-security-rules",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill odoo-security-rules",{"tool":50,"command":51},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill odoo-security-rules",{"tool":53,"command":54},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill odoo-security-rules","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fodoo-security-rules\u002FSKILL.md",true,[],[59,72,88,115,134,159],{"skillNo":60,"name":61,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":69,"publishedAt":31},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[64],{"categoryNo":65,"categoryName":66,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[70,71],"Test Skill","test",{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":31},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[79,80,81,82,83,84,28,85,86,87],"zustand store ts","zustand","store","with","types","middleware","community","create","typescript",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":97,"publishedAt":31},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[94],{"categoryNo":95,"categoryName":96,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000023","Skill与智能体开发",[98,99,100,101,102,103,104,105,106,107,108,109,110,111,85,112,113,114],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","critical","creation","webinars","composio","recordings","management","tracking",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":31},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[121],{"categoryNo":95,"categoryName":96,"taxonomyType":67,"taxonomyTypeDesc":68},[123,98,124,125,126,127,128,85,103,129,111,130,108,107,102,131,86,132,104,133],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":143,"publishedAt":31},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[140],{"categoryNo":141,"categoryName":142,"taxonomyType":67,"taxonomyTypeDesc":68},"01JBSEEDCAT000000000000009","前端开发",[27,144,145,146,147,87,23,148,149,150,151,152,82,153,154,155,156,85,157,158],"zod","zod validation expert","validation","react","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":31},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[165],{"categoryNo":95,"categoryName":96,"taxonomyType":67,"taxonomyTypeDesc":68},[167,168,169,170,171,172,173,174,85,175,176,177,178,179,180,181,182,183,184,104],"zeroize audit","audit","write","passwords","get","project","c++","activate","assembly","read","Bash","secrets","analysis","data","flow","verification","code","rust"]