Odoo v11项目权限配置求助：按角色实现权限隔离

Hey there! I’ve set up exactly this kind of permission scheme in Odoo v11 before, so let’s break it down into clear, actionable steps. We’ll tackle ACLs first, then record rules, and cover common pitfalls to fix your existing setup.

Step 1: Set Up Access Control Lists (ACLs) #

ACLs define the types of actions each user group can perform on a model. We’ll configure two groups: your Project Managers and Project Members.

For Project Managers #

1. Go to Settings > Technical > Security > Access Controls.
2. Find or create an access rule for the project.project model, assigned to your Project Manager group (you can use the built-in Project/Manager group or create a custom one).
3. Grant the following permissions:
   • ✅ Read
   • ✅ Write
   • ✅ Create (if you want managers to create their own projects)
   • ✅ Delete (optional, based on your workflow)
4. Repeat for the project.task model—grant full or partial access (managers usually need to manage all tasks in their projects, which we’ll restrict later with record rules).

For Project Members #

1. Similarly, create or edit the access rule for project.task assigned to your Project Member group (e.g., Project/User).
2. Grant:
   • ✅ Read
   • ✅ Write (so they can update their assigned tasks)
   • ❌ Create (unless you want members to create tasks for themselves)
   • ❌ Delete (optional, based on policy)
3. For project.project, grant at least Read access (so they can see the project their tasks belong to—we’ll narrow this with record rules too).

Step 2: Configure Record Rules (Restrict Visibility to Own Items) #

Record rules act as filters—they limit which specific records a group can access. This is where we enforce "only my projects" and "only my tasks".

For Project Managers (Restrict to Their Own Projects) #

1. Go to Settings > Technical > Security > Record Rules.
2. Create a new rule:
   • Name: Project Manager - Access Only Own Projects
   • Model: Project Project (select from the dropdown)
   • Group: Choose your Project Manager group
   • Domain: Enter this domain expression: [('user_id', '=', user.id)]
     • This tells Odoo: "Only show projects where the project manager (user_id) is the current logged-in user."
   • Permissions: Check Read, Write, Create, Delete (match what you set in ACLs)
   • Active: Make sure this is checked
3. Save the rule. Now managers will only see and manage projects they’re assigned to.

For Project Members (Restrict to Their Assigned Tasks) #

1. Create another new record rule:
   • Name: Project Member - Access Only Assigned Tasks
   • Model: Project Task
   • Group: Choose your Project Member group
   • Domain: [('user_id', '=', user.id)]
     • This filters tasks to only those where the member is the assigned user (user_id).
   • Permissions: Check Read and Write (match your ACL settings)
   • Active: Checked
2. (Optional) If you want members to only see projects that have their tasks, add a record rule for project.project for the member group:
   • Domain: [('task_ids.user_id', '=', user.id)]
   • This ensures they can’t browse projects they have no tasks in.

Common Pitfalls to Fix Your Existing Setup #

If your previous attempts failed, check these:

• Admin User Testing: Admin bypasses all record rules—always test with a real manager/member user.
• Conflicting Rules: Make sure there are no other record rules for the same model/group that grant broader access (e.g., a rule that allows all users to see all projects). Odoo combines rules with OR logic, so a wide rule will override your restriction.
• Correct Fields: Double-check that you’re using user_id for the project manager (in project.project) and task assignee (in project.task)—Odoo v11 uses these default fields, but if you customized the model, you might need to adjust the domain.
• Group Inheritance: If your custom groups inherit from built-in groups, ensure the inherited groups don’t have conflicting ACLs/rules. For example, if your manager group inherits Project/Manager, make sure the built-in group’s rules don’t override yours.

内容的提问来源于stack exchange，提问作者Trinh Nguyen