Thanks Oscar and Niyas for your replies and all the information!  This is a big help!   I'm looking at the groups now, trying to understand what they each enable.  Thanks again, Fred G

Hi,

The security in odoo is implemented using Groups, Access Rights and Record Rules. If you open users form view, ie, Settings -> Users & Companies -> Users, you can see a lot of groups visible in the form, the things(modules and records) that the user see will be based what is the groups assigned to him.

Suppose if you take the example of the Sales Module, it has got mainly three groups, in the users form view, you can see, User: Own Documents, User: All Documents and Administrator , so the user will see the sales module only if. any of this group is assigned to him. So if you don't want user to see sales module, you don't to assign any of this group to the user.

If you want users to see all the sale order, you can assign the group, User: All Documents and if user want to see only his own records, you can assign the User: Own Documents group.

For setting default access rights for newly creating user you can choose the method by Mr. Oscar Alca in his answer. Also see the same here: Default Access Rights For Newly Creating User in Odoo

For understand Odoo Security Mechanism: Security in Odoo - Access Control, Record Rules and Group

Thanks

Hello,

Odoo uses two inactive users as a template to create new users:

- Portal User Template, Used for external users (not your case)

- Default User Template,  Used internal users.

you need to edit the Default User Template permissions as you preffer, so the permissions can be replicated in the newly created internal user, you can do it by going to Settings > Scroll down to the Users section  > Enable Default Access Rights checkbox, then under the checkbox you will se a green link to Default Access Rights, click on it and it will take you to the Default User Template, set the permissions that you want for new users and save.

The the best way to see if this as you expect is to test with a personal email all the permisions you set to the Default User Template user.

 You need to set the permissions you want by default to the 'Portal Template User' to do it