Hi Rawan,

In standard Odoo, “Published on Website” is controlled by the website publish toggle (is_published / publish button). There isn’t a complete built-in “approval workflow” specifically for product publishing, but you can achieve what you want with access rights + record rules, and only go custom if you need a multi-step approval process.

Create two groups/roles:

1. Product Editors

• Can create/edit product.template (and variants as needed)

• Cannot change website publishing fields

1. Product Publisher (Admin/Website Manager)

• Can publish/unpublish on the website

How to implement:

• Give “Product Editors” create/write rights on Products.

• Add a record rule or ACL limitation that blocks writing to the publish field for that group.

  • Practically: allow write on products, but prevent writes to website_published/is_published unless user is in the publisher group.

  • This typically requires a small customization (even if tiny), because ACLs can’t restrict specific fields—only models. Record rules restrict which records, not which fields.

So if you truly want “edit everything but the publish toggle”, you usually need a small custom module to enforce this at field level (server-side).

If you want a real approval step, do this:

• Add a field like x_approval_state on product.template: draft → to_approve → approved

• Hide/disable the Publish toggle for non-admin users (UI)

• Add a server-side check in write():

  • If someone not in “Publisher” group tries to set is_published=True, raise an error

  • Only allow publish when x_approval_state == 'approved' and user in Publisher group

• Add buttons:

  • “Submit for Approval” (sets to_approve)

  • “Approve” (publisher only → sets approved)

  • Then publisher can publish

This is clean, auditable, and avoids users “accidentally” publishing.

• Pure built-in: no dedicated approval workflow for publishing products.

• If you only need “only admin can publish”: you’ll likely need a small custom module (because you must restrict a specific field write server-side).

• If you need a real approval process: definitely custom module (simple state + permissions + optional chatter/activity for approval).

Regards,
Santosh S

Hope it helps