Hello, I understand Odoo restriction policy must be implemented at 99% in server side.

At first: server method and fields are public with xml-rpc, because that I recommend as a good security practices implement all restrictions in server side like this:

fieldXXX = fields.Date('Field to restrict', required=True, default=fields.Date.today())

@api.one

@api.constrains('fieldXXX')

def _check_fieldXXX(self):

     if (fields.Date.from_string(fields.Date.today()) - fields.Date.from_string(self.fieldXXX)).days ...............:

         raise Warning(_('Anything you want to raise'))

If restrictions doesn't appear in python code third party codes must write incorrect values into your entities.

I hope this answer help you.

Hi Rafael,
thanks for your answer, i ll try it on my code for sure and then let you know.