Attachment Delete Restriction

In standard Odoo any user who can edit a record can delete its attachments and chatter messages, which erases evidence. This module restricts deletion to a dedicated Attachment Delete Manager group, in the attachment model, the chatter message model and the web controllers that serve the delete buttons. Deletions by the allowed group leave an audit entry in the chatter. It works across all apps and protects documents, invoices and correspondence.

1. 1

   Assign the manager group

   Add the trusted users to the Attachment Delete Manager group in Settings > Users. Everyone else loses the ability to delete. The group check is applied server-side.

   • Group: attachment delete manager
   • Server-side check
2. 2

   Delete an attachment

   A normal user pressing delete on an attachment in the chatter or form gets an access error. A manager can delete it. The web controller for attachment deletion enforces the same rule.

   • AccessError for others
   • Controller enforced
3. 3

   Protect chatter messages

   Editing or deleting protected messages is also limited to the manager group. Cascade deletions by the system are allowed to avoid breaking normal flows. Ordinary notes stay editable by their authors where permitted.

   • Message edit/delete restricted
   • System cascades allowed
4. 4

   Read the deletion audit

   When a manager deletes an attachment or message, an audit entry is written in the record chatter naming what was removed. It keeps a trail for reviewers. Multi-company rules are respected when preparing the entry.

   • Audit chatter entry
   • Multi-company aware

Back to version applications