Contents10
An ERP puts all the company’s data in one database. That is its strength, and it is also what makes it necessary to say clearly who sees what. A sales rep has no business seeing salaries; an intern has no business approving a supplier payment.
In short
Rights by role, not by person.
The minimum needed to work, nothing more.
Separate who creates an expense from who pays it.
Limit access to margins, salaries and bank details.
Two-factor authentication for all, and access removed on the day someone leaves.
Roles, not people
Defining rights person by person quickly becomes unreadable. Define roles instead (sales rep, sales administration, buyer, warehouse worker, accountant, leadership) and give each person one or more roles. Odoo organises its rights in groups per app, Dolibarr in permissions per module, which can be grouped by user group. Odoo’s documentation on access rights describes the principle.
The minimum needed
Each role gets what it needs for its daily tasks, and nothing more. The reflex “give them all the rights, it will be simpler” creates risks: a deletion by mistake, sensitive data seen by the wrong person, and no way of knowing who did what.
Segregation of duties
A classic internal control rule: the person who creates an expense is not the one who pays it. In the ERP, that means separate rights to enter a supplier invoice, approve it and put it up for payment. Above a certain amount, an extra approval from leadership. This separation protects the company against fraud and against error.
Sensitive data
To restrict
Margins and purchase prices
Salaries and HR data
Third parties’ bank details
To open widely
Customer records and contacts
Catalogue and sales prices
Order and delivery status
Personal data also falls under GDPR: every access must have a work-related reason. Our article on GDPR in a CRM details the retention rules, which also apply to ERP records.
Several companies
In a multi-company ERP, rights also say which company each user sees. The group controller sees everything; a subsidiary’s team sees only its own. See Multi-company ERP.
The accounts themselves
- Two-factor authentication
For every account, without exception.
- Named accounts
Never a shared “accounts” or “warehouse” account.
- Removal on the day of departure
Built into the exit procedure.
- Quarterly review
Of active accounts and their roles.
Named accounts have a second advantage: the ERP’s log says who changed what, which settles many internal disputes.
External access
Accountant, provider, temp worker: each gets a named account, limited in time and scope. Customers and suppliers go through the portal, which only gives access to their own documents.
Activity logs
Odoo and Dolibarr keep a trace of creations and changes. Check it during the quarterly review, especially deletions, changes to supplier bank details and payment approvals. A change of supplier bank details followed by a payment is one of the most common fraud patterns; a double approval on that field blocks it. The same control applies to exceptional discounts and credit notes, which take money out of the company as surely as a direct payment to a supplier.
Setting rights during configuration
Rights are defined with the flows, during scoping, not after go-live. A simple table is enough: roles in rows, apps in columns, and for each cell read, write, approve or nothing. This table then serves as the reference for the quarterly review and for each new hire. The complete ERP guide shows the other project steps, and our CRM and ERP offer delivers this role table with the ERP configuration.
Frequently asked questions
How many roles should you define?
As many as there are different jobs in the ERP, often between five and ten. Beyond that, roles overlap and become hard to maintain. A person holding several functions gets several roles, which stays more readable than tailor-made rights.
Should administrators see everything?
The technical administrator needs to configure the tool, not necessarily read salaries. Separate the technical administration role from access to sensitive data as far as possible, and limit admin accounts to two or three identified people, whose actions are traced in the log.
What about former employees’ accounts?
Deactivate them on the day of departure, without deleting them: document history must keep the name of who created them. A quarterly review catches oversights, by comparing the list of active accounts with the headcount list kept by HR.
Sources
Jim · founder of Brain Plus AI
Also in erp: odoo and dolibarr
Practical guide5 min The topic guide
ERP for a company of 20 to 500 people: the guide
An ERP brings sales, purchasing, stock and invoicing into one database. This guide explains when it becomes useful, how to choose between Odoo and Dolibarr, and what makes the project succeed or fail.
Understand3 min
Multi-company ERP: several entities in one database
A subsidiary, a holding company, one company per country: managing several entities in one ERP avoids multiplying tools. What it takes, and the traps to avoid.
Understand4 min
AI in an ERP: what really helps, what can wait
Reading supplier invoices, bank reconciliation, answering questions about the data: AI has solid uses in an ERP, others are still demos. The sorting, use by use.