Hi,

Why employees can edit department, approvers, and company data

* When you give an employee’s user permission to edit their own record, Odoo applies the general “write” rights on the hr.employee model.

* By default, this model has no distinction between private information (emergency contact, bank account, etc.) and work-related information (department, manager, job position). Both are just fields of the same model. That’s why users suddenly see and can edit fields you don’t want them to.

* The same applies to the res.company model: internal users often get write access by default to company contact details, which is why normal employees can change company VAT, phone number, or address.

How to solve it

To achieve your requirement (employees edit their private data, but not work/company details), you need to refine access control:

1- Record Rules:

Create a rule so that employees can only see/write their own employee record (['|',('user_id','=',user.id),('address_home_id.user_id','=',user.id)]).

2- Field-level security (requires customization):

In Odoo Community, you can’t natively restrict editing certain fields only. That feature (field-level ACLs) is more present in Enterprise + Studio. In Community, the workaround is to hide or readonly fields with groups in views.

Example: make the “Department”, “Manager”, “Company” fields attrs="{'readonly': [('id','!=',user.employee_id.id)]}" or restrict with groups_id.

3- Remove company write access:

Go to Settings → Technical → Security → Access Control Lists and adjust permissions on the res.company model so normal employees don’t have write rights. Usually, only “Settings” users should be able to edit company info.

You’re not doing anything wrong, it’s just that Odoo 18 CE doesn’t separate private vs work fields in the hr.employee model. To fix it, you’ll need to add a record rule limiting employees to their own record and adjust views/security groups so they can edit only private fields while company and work-related fields stay read-only.

Hope it helps.

Dear Gon,

thanks for the advice. This is basically the route that I have taken before. 

The Test User has no rights except his own ones in the profile. Yet he is able to change the mentioned data. The individual access rights and record rules in the groups setting have not been touched by me so far.

Thanks a lot anyway for the URL to the documentation.