Settings and Technical Configuration
What to know
Most configuration sits in the Settings app, but access control and automation live in the technical menu, which requires developer mode (activated from Settings, or via the URL parameter). Key technical objects: models and fields (database structure), views, actions (window, server, report), scheduled actions (cron), automated actions, sequences, email templates, record rules and access rights.
Access control has two layers: ACLs (ir.model.access) grant create/read/write/delete on a model to a group, and record rules (ir.rule) filter which rows that group can see (global rules are ANDed, group rules are ORed together). Groups inherit from other groups, so implied groups widen rights. Multi-company requires the user's allowed companies to be set and company-dependent fields (company_id) to be handled; record rules are usually per company. Language activation, translations, data import with external IDs, and export round out administration.
Traps
- Without developer mode, the technical menu is invisible - many questions test this.
- An ACL without a record rule grants broad row access; a rule without an ACL still blocks everything (both are required).
- Global record rules restrict everyone, including managers; group rules are additive.
- Scheduled actions run as a specific user, so their permissions matter.
- Importing without external IDs creates duplicates on re-import.
Rule of thumb
Diagnose “user cannot see a record” as: does the group have the ACL, and does any global rule exclude it? Example: a rule [('company_id','=',company_id)] on invoices plus an ACL granting read gives a multi-company user only their company's invoices.