Hi, we are using Odoo Online and Studio.

we would like to restrict the ability to edit any of the records, for a certain group of users, only allow them to view the records and to add Log Notes to the records.

I have attempted to use Record Rules for this, but the issue we run into is that the Access Group that all internal users belong to, "User types / Internal User", grants Edit access to all records by default and it does not appear you can reduce the users access only expand the users access via these rules, by say adding them to another group and limiting the edit capability on that group. Odoo appears to grant greatest access privilege, instead of least access privilege.

If we remove the users from the "User types / Internal User" group then they can no longer access the app, and in Odoo Online, there does not appear to be a a way to duplicate the "User types / Internal User", so we can then jut modify the edit access and keep all the other Access Rights and Record Rules associated with that group that provides the user access to the basic platform and apps.