# Access Rights

There are 5 levels of access rights: Model , Actions, Field, Button and Record Rule. They are based on the user’s group membership. If any of those levels are violated, an error is raised.

The access rights are checked if the `Transaction.context` has the key `_check_access` set to `True` (set by default by `RPC.check_access`) and if the `user` is not `root`.

## Model

They are defined by records of `ir.model.access` which define for each couple of model and group, the `read`, `write`, `create` and `delete` permission. The permissions are related to the `ModelStorage` methods with the same name and on `search()` using the `read` permission.

If any group the user belongs to has the checked permission activated, then the user is granted this permission.

If there is no record for the model, then access is granted to all users.

Note

Relation fields for which the user has no read access are automatically removed from the views.

## Actions

Each `ir.action` has a `groups` field which contains a list of user groups that are allowed to see and launch it.

There is a special case for wizard for which the read access on the model is also checked and also the write access if there is no groups linked.

## Field

They are defined by records of `ir.model.field.access` and work like those for Model but are applied to fields.

Note

Fields for which the user has no read access are automatically removed from the views.

## Button

For each button of a model the records of `ir.model.button` define the list of groups that are allowed to call it. The user only needs to belong to one of the groups to be granted the permission to use it.

If no group is defined for a button, the `write` permission to the model is checked instead.

The `read` permission to the model is always enforced.

Note

Buttons for which the user has no access are marked readonly.

### Button Rule

The `ir.model.button` can contain a list of rules which define how many different users must click on the button. Each rule, for which the condition is met, must be passed to actually trigger the action. The counter can be reset when another defined button is clicked.

## Record Rule

The record rules are conditions that records must meet for the user to be granted permission to use them. They are defined by records of `ir.rule.group` which contains:

> - a model on which it applies

> - the permissions granted

> - a set of user groups to which the rule applies

> - a global flag to always enforce

> - a default flag to add to all users

> - a list of `ir.rule` with a domain to select the records to which the rule applies.

A rule group matches a record if the record is validated by at least one of the domains. The access is granted to a record:

> - if the user belongs to a group which has at least one matching rule group that has the permission,

> - or if there is a default matching rule group with the permission,

> - or if there is a global matching rule group with the permission.

Otherwise the access is denied if there is any matching rule group.

Note

Records for which the user has no `read` access are filtered out from the `search()` result.