Skip to content

AI Tool - Read

ai_tool_read · OCA/ai

Follow
    Health
    60/100
    fair
    • Security25/25
      No findings
    • Activity25/25
      Human commit this month
    • Required by5/25
      0 modules depend on it
    • Maturity5/25
      In 1 Odoo series since 16.0

    Heuristic over the facts below, not an audit · How it's computed

    Security findings
    Grave / minor (static analysis)
    Required by
    0
    Modules depending on it
    External deps
    0 pip · 0 bin
    Python packages / system binaries
    License
    AGPL-3
    No conflicts with its dependencies
    Folder size
    0.08 MB
    Module directory on disk
    Code analysis 1 migration note 2 models 4 views 0 HTTP endpoints

    Description

    Adds ai_tool tools to let an AI agent read any model and field it is allowed to access, while keeping personal or otherwise sensitive fields out of the results.

    A flag AI Read Forbidden (ai_no_read) is added to fields. The tools never return nor describe a forbidden field, nor any field exposing its value: related fields, including those delegated through _inherits, and computed fields depending on it. Flagging res.partner.email thus also hides email_formatted, email_normalized and res.users.email.

    Three tools are provided:

    • list_models: lists the models the current user is allowed to read.
    • get_fields: describes a model's readable fields (label, type, help, selection options and relation target), and lists the forbidden ones under hidden.
    • search_read: searches and reads records of a model. It returns the stored fields unless a field list is given, relational fields as record IDs, and dates in UTC. Results are paged with limit and offset, and has_more tells whether more records match. A field whose computation is refused for the user is left out and listed in inaccessible_fields, and a record the search finds but the user cannot read (as ir.attachment allows) is left out without notice, as record rules would.

    The tools run with the calling user's own access rights (no sudo), so Odoo ACLs, record rules and field groups still apply. Connect the agent as a user with no more rights than it needs: an administrator sees every field restricted by groups.

    Besides forbidden fields, the results leave out binary fields, fields pointing to a model the user cannot read (reading them would fail), and display names computed on the fly, including the one Odoo adds to many2one values: they are built from other records' fields, which may be forbidden there.

    The flag keeps values out of the results, not out of searches: see Known issues.

    Dependencies

    Odoo dependencies
    OCA/ai:
    - ai_tool
    odoo/odoo:
    - mail
    - base
    - base_setup
    - web
    - bus
    - web_tour
    Python dependencies
    None
    System dependencies
    None
    Required by
    None

    Code analysis

    Extracted from the source by best-effort static analysis (no code is executed); details may be incomplete.

    Views touched 4

    XML IDNameModelTypeStatus
    ir_model_fields_view_form ir.model.fields form Inherits base.view_model_fields_form
    ir_model_fields_view_search ir.model.fields search Inherits base.view_model_fields_search
    ir_model_fields_view_tree ir.model.fields tree Inherits base.view_model_fields_tree
    ir_model_view_form ir.model form Inherits base.view_model_form

    HTTP endpoints 0

    No HTTP endpoints found for this module.

    Models touched 2

    New fields (0)

    No new fields.

    Public methods (0)

    No public methods.

    New fields (1)
    • ai_no_read Boolean
      default=False help="If enabled, the generic AI read tools leave this field out of the records they return and of the fields described by get_fields. It does not stop an agent from filtering or sorting on the field (see the module's Known issues). Use it to keep personal or otherwise sensitive values out of the results given to AI agents." index=True string='AI Read Forbidden'
    Public methods (1)
    • write(self, vals)

    Loading…