Connecting an AI agent to Odoo without breaking user permissions

What the usual integration gets wrong

The typical integration stores one API key and uses it for every request. The agent therefore sees the union of whatever that key can see, for every employee. A salesperson can ask the chat about a colleague's payroll, and the agent will answer.

This is not a bug but a structural consequence of the design. The controls usually on offer (an allowed-tool list, a write switch) are all agent-wide, and none of them vary by who is asking.

Identity comes from Odoo, not the browser

First rule: never let the browser decide who the user is. If your system accepts a user id from the request body, anyone can type someone else's and read their conversations and data.

The correct shape: the Odoo server signs a short-lived assertion stating who the current user is, read server-side from `request.env.user`. The browser only carries the sealed envelope and cannot alter what is inside.

• Sign the assertion with a shared secret and keep its lifetime short: two minutes is plenty.
• Give each assertion a single-use nonce, or a captured one can simply be replayed.
• Refuse the superuser (`uid <= 1`) explicitly at every layer.

Writes need a human gate

Reads can be delegated confidently because Odoo guards them. Writes are another matter: creating an invoice or amending an order is irreversible. Every write should be shown to the user in its final form and wait for explicit approval in the chat.

And log every write to an audit trail attributed to the real user, not to "the agent". When something goes wrong and someone investigates, the difference between those two is everything.