Model Access Rules
Whitelist Odoo models and configure per-model CRUD permissions for MCP tools
Model Access Rules
Model Access Rules (ai_connector.model_policy) are the MCP-level CRUD allowlist. Only models with an active policy record are accessible to MCP tools — even if the Odoo user already has full ORM rights.
[!IMPORTANT] Model Access Rules are an additional allowlist on top of Odoo native security. A model must pass both the MCP policy check and Odoo’s native ACL / record rules before data is returned.
Policy Fields
| Field | Type | Description |
|---|---|---|
model_id | Many2one (ir.model) | The Odoo model to expose. One policy per model (SQL unique constraint). |
model_name | Char (stored related) | Technical model name, e.g. sale.order. |
active | Boolean | When unchecked, the model is treated as not configured. |
can_read | Boolean | Allows search_read, read, search_count, read_group, name_search, get_record_summary. Default: True. |
can_create | Boolean | Allows create. Default: False. |
can_write | Boolean | Allows write, archive, unarchive. Default: False. |
can_delete | Boolean | Allows unlink (always routed through approval queue). Default: False. |
notes | Text | Admin notes — not used by the engine. |
Create a Rule (Single Model)
[!NOTE] Screenshot — Model Access Rules form
Place a screenshot of the Model Access Rules form view here, showing the model selector and CRUD checkboxes. Suggested filename:
model-access-form.png
- Go to MCP Server → Model Access Rules.
- Click Create.
- Select the Model (type to search — e.g.
Sales Order→sale.order). - Enable the desired operations: Can Read, Can Create, Can Update, Can Delete.
- Ensure Active is checked.
- Click Save.
Batch Configure Models (Wizard)
For multiple models at once, use the Batch Configure Models wizard:
[!NOTE] Screenshot — Model Access Rules list + Batch Configure button
Place a screenshot of the Model Access Rules list view showing the “Batch Configure Models” button in the list header. Suggested filename:
model-access-list-batch.png
- Go to MCP Server → Model Access Rules.
- Click the Batch Configure Models button in the list header.
- Select one or more models from the filtered list (transient models,
ir.*, andbase_*are excluded). - Set the CRUD flags to apply to all selected models.
- Click Apply.
[!WARNING] The batch wizard only creates new policy rows. It does not update permissions on models that already have an existing policy. Edit those individually.
Permission Mapping
The MCP engine maps ORM/RPC method names to the four policy actions:
| ORM Method | Maps To | Required Flag |
|---|---|---|
read, search_read, name_search, search_count, read_group | read | can_read |
get_record_summary, fields_get, describe_model | read | can_read |
create | create | can_create |
write, archive, unarchive | write | can_write |
action_*, button_*, do_* | write | can_write |
message_post, activity_schedule, message_subscribe | write | can_write |
unlink | unlink | can_delete |
Example: Enable sale.order for Full Read + Write
Model: sale.order (Sales Order)
can_read: ✓
can_create: ✗
can_write: ✓
can_delete: ✗
active: ✓With this rule, an AI client can:
- Search sales orders (
odoo_search_read,odoo_query) - Read individual records (
odoo_get_record_summary) - Update orders (
odoo_write) - Confirm orders (
odoo_action→action_confirm)
But cannot create new orders or delete them.
Verify a Policy Programmatically
# In Odoo shell
env['ai_connector.model_policy'].verify_model_allowed('sale.order')
# → True / False
env['ai_connector.model_policy'].validate_action_allowed('sale.order', 'read')
# → True / False