Management wanted to stop filing a ticket for every new chart. The answer was a no-code dashboard builder: pick a model, pick fields, add filters, drag the result onto a grid.
That kind of feature is the classic place where access rules get bypassed — either by running queries with elevated rights for convenience, or by trusting a filter string sent from the browser. Ours does neither.
Filters are stored as typed condition records. Each value is cast by its stored field type before a query is built, unknown fields are skipped against a whitelist, and data is read in the viewer's own environment with explicit access checks at every entry point. A dashboard shows each viewer only the rows their access rights already allow.
On top of that sit 35 OWL components — the grid editor, a widget palette, six editor panels, nine filter types and the save, template and theme dialogs — covering KPI cards, charts, pivots, lists and financial tables.
It's now our largest UI system. Because the safety lives in the data layer rather than in the screens, we could reuse the same foundation on our other Odoo platform.
Read the case study: Dashboards management builds itself, without seeing data it shouldn't