Sometimes in a system you want users to have access to a particular model, but not to all records in that model. For example, you may want users to have access to phone calls within the system, but only to records of their own phone calls rather than all calls from the whole system. When you need to control user access based on the contents of records within a model, you can define Rules.

For this example, we are looking at the rules for the Sales / User: Own Documents Only group. Because this is a very restricted group, there are many rules that limit users in this group, meaning they only see records that are associated with them personally:

Typically, manager groups will have little or no rules because they do not have restrictions on what records they can access. Groups such as Own Documents Only have quite a few rules so that users can't see records that do not belong to them. Let's take a quick look at the Personal Orders rule so we can see how to construct a rule that limits what records a user can access:

Odoo provides a pretty good description at the bottom of the form on how rules interact. If no groups are specified in the list, this means that this rule will apply to everyone-all groups. As you can see in the preceding screenshot, you can specify the access rights for this rule. So, you could have a rule in which a user can access (read) certain records, but they would not be able to create, write, or delete records.

The most important part of the rule is the Rule Definition or Domain Filter. This is the filter that is applied to each record to determine if that record should be available. While the syntax may look a bit cryptic, you can see that the system is checking that user_id is equal to the current user_id. Specifically, this filter will be true if you are looking at your own records, or records that have not been assigned to any specific user.