Know who can open Access Control Studio, who can change rules, and who is never limited by those rules.
Overview
Access Control Studio has its own permission levels. Getting this wrong is the most common reason people say “the rules don’t work” or “I locked myself out.”
There are two ACS roles:
- Manager – designs and maintains Access Profiles.
- Administrator – full ACS control, and not restricted by any profile.
Everyone else is an ordinary Odoo user. They never open this app; they only feel the limits you assign.
How It Works
Managers can create profiles, assign users/groups, use Test as User, and import/export. When a Manager works in Sales or Contacts as themselves, ACS rules on their own user still apply.
Administrators are exempt from ACS restrictions so they can always fix configuration. That is why testing while logged in as Administrator is misleading – you will see menus and buttons that staff cannot.
Keep at least one trusted Administrator account. Give Manager rights only to people who should design access (HR ops, IT, department leads).
Step-by-Step Guide
- Open Settings → Users & Companies → Users.
- Open the person who will configure access.
- Enable Access Control Studio / Manager for day-to-day profile work.
- Enable Access Control Studio / Administrator only for trusted system admins (implies Manager).
- Confirm they can open the Access Control Studio app.
- For verification, always use Test as User with a normal staff account – not an Administrator.
Fields Table
These are the settings you will see for this feature, explained in everyday language.
| Field Name | Description | Example |
|---|---|---|
Access Control Studio / Manager |
Can open ACS and manage profiles. |
HR or department lead |
Access Control Studio / Administrator |
Full ACS access; profiles do not restrict this person. |
IT / system admin |
Ordinary user |
No ACS app; only receives profile limits. |
Salesperson, warehouse clerk |
Test as User |
See Odoo as a normal user despite being a manager. |
Required before go-live |
Field Explanations
Each field from the table above is explained in more detail here.
Access Control Studio / Manager
Enough for almost all configuration work. Managers still experience ACS rules when using Odoo as themselves.
Access Control Studio / Administrator
Use sparingly. Exemption prevents lockouts and lets admins rescue bad profiles.
Ordinary user
Never needs ACS rights. Assign them to profiles instead.
Test as User
The correct way for Managers and Administrators to validate what staff will see.
Tips
- Maintain a written list of who is Manager vs Administrator.
- Do not make every manager an ACS Administrator “just in case.”
- If rules seem ignored, check whether the person is an ACS Administrator.
Common mistakes
- Testing profiles while logged in as Administrator and concluding rules failed.
- Giving Administrator to many people – they bypass all ACS limits.
- Applying Disable Login to the only Administrator without a backup account.