Permissions & Access Control
Layered security model — gateway, authentication, credential flags, model policies, and Odoo native ACL
Permissions & Access Control
The Odoo AI MCP Server uses a 5-layer security model. Every MCP tool call must pass all five layers before data is accessed or modified. The AI assistant can never escalate beyond the authenticated Odoo user’s native permissions.
The 5-Layer Security Model
Layer Details
Layer 1 — Gateway Active
The global master switch (ai_integration.enabled). When off, is_gateway_active() returns False and every /mcp request returns HTTP 503 immediately — no auth is attempted.
[!NOTE] The gateway flag is cached for 5 minutes. Disabling it in Settings may not take effect instantly.
Layer 2 — Authentication
Bearer token (API key or OAuth access token) or active Odoo session. See Authentication for full details.
Layer 3 — Rate Limiting
Per-user, per-minute sliding window counter. Only enforced when ai_integration.enable_rate_limiting = True. See Rate Limiting.
Layer 4 — Model Policy (ai_connector.model_policy)
The MCP-specific allowlist. evaluate_gateway_access() checks:
verify_model_allowed(model_name)— an active policy row exists for this model.validate_action_allowed(model_name, operation)— the resolved operation (read/create/write/unlink) is permitted by the policy flags.
Layer 5 — Odoo Native Security
The tool call runs as env = request.env(user=user.id). All Odoo access control applies:
| Mechanism | Description |
|---|---|
| ir.model.access | Model-level CRUD via security groups |
| Record rules | Domain-based row filtering per group |
| Multi-company | User sees only allowed company records |
| Field-level security | groups attribute on fields |
Permission Map (from ARCHITECTURE.md)
MCP tool
→ run as authorizing OAuth/session user (full Odoo ACLs)
→ ORM method name
→ resolve_rpc_method_to_action()
→ read | create | write | unlink
→ ai_connector.model_policy can_* flag (extra allowlist)
→ unlink → odoo_ai_mcp.approval queueMCP Policy vs. Odoo ACL
| Aspect | MCP Model Policy | Odoo Native ACL |
|---|---|---|
| Configured in | MCP Server → Model Access Rules | Settings → Users → Access Rights |
| Granularity | Per model, per CRUD operation | Per model, per group |
| Record-level | No (model-level only) | Yes (record rules with domain) |
| Evaluated by | evaluate_gateway_access() in controller | Odoo ORM layer |
| Failure mode | isError: true in MCP response | AccessError exception caught as isError: true |
| Purpose | Additional allowlist (opt-in per model) | Core Odoo security |
[!IMPORTANT] The MCP policy does not replace Odoo security. A model must pass both the MCP policy check and the Odoo ACL check. Granting MCP
can_readon a model does not grant the Odoo user read access they didn’t already have.
Security Group Reference
| Group | XML ID | Typical Members |
|---|---|---|
| MCP Server User | group_ai_integration_user | Any Odoo user whose credentials are used by AI clients |
| MCP Server Administrator | group_ai_integration_admin | IT / admin users who manage settings, policies, and logs |
base.group_system (Technical Admin) automatically inherits group_ai_integration_admin.