In any business application, controlling who can see what data is just as important as storing the data itself. Odoo provides a powerful mechanism called Security Domains to filter records based on conditions so different users only see the data that is relevant to them.
By default, all users with access to a model can see all its records. But what if you want a salesperson to only see their own orders or a manager to see records from their department only? This is exactly where security domains come in handy.
This blog explains what security domains are in Odoo 19 and how to use them. We'll use a custom Book model as our example, since it gives us full control to define the fields and domain behavior from scratch.
The module demonstrates how security domains work in Odoo 19. It includes:
A custom Book model with a name field and a user field
A record rule that uses a domain to restrict each user to only see their own books
The use of domain syntax [('field', 'operator', 'value')] inside a security rule
No complex code needed just a clean XML record rule with a domain filter
In Odoo, a security domain is a filter written as a list of conditions. It follows this syntax:
This model defines a Book record with two fields name and user_id. The user_id field is a Many2one field linked to res.users it stores which user the book belongs to. The default=lambda self: self.env.user automatically sets the current logged-in user when a new book is created.
2. Create the View
Create the form and list view so users can interact with the Book records.
views/book_views.xml
The form view displays the book name and the user it belongs to. The list view shows all books with their owner. A menu item is added so that Books appear in the top navigation bar.
3. Access Rights
Add the access rights file to allow users to read, write, create, and delete Book records.
security/ir.model.access.csv
4. Security Rule with Domain
Create a security rule XML file. This is where the domain filter is defined restricting each user to only see their own Book records.
security/security_rules.xml
The record rule uses the domain [('user_id', '=', user.id)] this means each user can only see books where the user_id field matches their own user ID. The rule applies to read, write, create, and delete operations. Since no group is specified, the rule applies to all users by default.
Output
After installing the module, navigate to Books from the top menu. Each user will only see the books they created. This confirms that the security domain is working correctly.
User A logs in and sees only their own books
User B logs in and sees only their own books. User A's books are completely hidden
The domain filter [('user_id', '=', user.id)] is applied automatically by Odoo for every query
Conclusion
Security domains in Odoo 19 are a simple but powerful way to control which records each user can access without writing any complex Python code. By defining a domain filter inside a record rule, you can restrict data visibility based on any field condition.
By using this approach, you ensure that sensitive data stays protected and each user only sees what is relevant to them, improving both security and usability of your module.
If you are looking for an ERP implementation partner with diverse industry experience feel free to contact us. We have proven track record of successful implementations across various sectors including Odoo for Manufacturing, Odoo for Trading, Odoo for FMCG, Odoo for Oil & Gas, Odoo for Diary, Odoo for Pharma, Odoo for Cosmetic Clinic, Odoo for Contracting Companies, Odoo for HVAC, Odoo for Logistics, Odoo for Automobile, Odoo for Laundry, Odoo for Field Service, Odoo for E-Commerce & many more
ZestyBeanz offers Developer / Consultant outsourcing programs, Chat with us in Whatsapp and Hire Odoo Developers, Mobile Application Developers, Consultants.
