BambooForge Labs

Access Manager compared with the alternatives

Grant access by named role instead of by guesswork, copy one user's rights to another, hide the menus, fields, buttons, tabs and reports a role should not see - no code - and get told exactly which rule blocked someone.

Read the manualOpen the live demoBuy on the Odoo Apps Store

Checked on 2026-10-15. Prices are the Odoo Apps Store's prices in euros on that day (visitors outside the euro area see them converted); features are as each vendor's own public page describes them. If something here is out of date, write to support@bambooforge.dev and we will correct it.

At a glance

BambooForge Access Manager

OCA base_user_role (free)

Odoo itself

Terabits Simplify / Advance Access Management

Price

EUR 229, once per Odoo series

Free (LGPL-3); its history and company add-ons are AGPL-3

Part of Odoo; Studio is an Enterprise module (OEEL-1)

Simplify EUR 393.71, once per series, with the Advanced Web Domain Widget it needs; Advance EUR 568.61, which includes both

Odoo series

16.0, 17.0, 18.0, 19.0, 20.0

16.0 to 19.0

Built in; Studio in Enterprise 16.0 to 20.0

Simplify 12.0 to 20.0; Advance 13.0 to 20.0

Roles and bulk changes

Roles (named bundles of groups) applied with Add or Replace after a per-user preview of the groups gained and lost; copy one user's access to another; add or remove groups in bulk

Roles built from groups, which add up; a change to a role updates all its users at once; "Create role from user"; roles per company with base_user_role_company

Groups; 19.0 adds Privileges (res.groups.privilege)

Not described

Finding why a user is refused

Explain access: user, model, operation and an optional record give a verdict in words, naming the access lines and rules that grant or exclude it

Not described

Each group's form lists its access rights

Not described

History of access changes

A change log of who changed whose groups; append-only

With base_user_role_history: a line for each role added, updated or removed on a user, and who did it

20.0 logs each group change in the user's chatter and the server log

Not described

Segregation of duties, end dates

Pairs of groups one person must not hold, blocking or warning; grants that end on a set date

Roles bounded by dates

Not described

Not described

Hiding parts of the screen

Menus, fields, buttons, tabs, blocks, the chatter, Action and Print entries, per role, group or user; read-only fields; "See it as a user"

Not described

With Studio (Enterprise), a field is shown to or hidden from chosen groups

Menus and sub-menus; fields invisible, read-only or required; buttons, tabs and chatter; filters, groups and views. Advance adds conditional field, button and tab rules, and limits on the search panel, custom filters and group-by

Switching off actions on a model

No create, edit, delete, duplicate, export or import, or the whole model read-only

Not described

Create, read, write and delete per group, with record rules beside them (16.0 to 19.0); on 20.0 one ir.access model, where a line can carry a domain and a line with no group is a restriction

Create, read, update, delete, archive, duplicate and export per model; domain access rights; import and export hidden; read-only users. Advance adds "Soft Restrict" and global rules

Left out, as each page says

"A user who knows the model name can still reach the record over RPC with whatever their groups allow"; of the switches, only export, import and duplicate are refused on the server. The superuser is never restricted

Groups cannot be set by hand on a user who has roles; deleting a role deletes its history lines

Not listed

Simplify: several items are marked Advance-only

An audit trail of changes to your records is a separate BambooForge app, Audit Pro, and is not compared on this page.

Choose which, and when

  • Choose OCA's base_user_role if you run 16.0 to 19.0 and want a free role layer (LGPL-3, Production/Stable) in which each user's groups follow their roles exactly, with add-ons for a role history and roles per company. It has no build for 20.0 today.

  • Choose Odoo's own access rights if groups, access lines and record rules cover what you need (on 20.0, one ir.access model with the domain on the line itself), and the chatter and server-log entry that 20.0 writes for each group change is all the history you need. On Enterprise, Studio also shows or hides a field per group.

  • Choose Terabits Simplify Access Management if you want screen and model restrictions with switches for read-only users, developer mode and login, rules per company, restrictions its page says also apply to "Script/XMLRPC", and a series as old as 12.0.

  • Choose Terabits Advance Access Management if you also need conditional field, button and tab rules, "Soft Restrict", limits on the search panel, custom filters and group-by, and rules for portal users as well as internal ones. Its price includes Simplify.

  • Choose ours if you are on any of Odoo 16.0 to 20.0 and want roles, copies and bulk changes previewed before anything is written, a verdict in words on why a user is refused, segregation-of-duties rules, grants that end on a date, and screen restrictions per role, group or user, with nothing to install beyond base - and you accept that, apart from export, import and duplicate, those restrictions shape the screen, while the user's groups decide what a call over RPC may do.

Sources

Read on 2026-10-15.