Dashboards management builds itself, without seeing data it shouldn't
A drag-and-drop builder driven by typed, whitelisted conditions, so every viewer sees only what their access rights allow.
The problem a client brought us
“Every new chart or KPI dashboard our management team wants means filing a dev ticket and waiting. We need people to build their own.”
Before and after
What a generic builder would accept
- Any model
- Any field
- Any filter the browser sends
What ours accepts
Typed, whitelisted conditions
What we found and built
A drag-and-drop, no-code dashboard builder — KPI cards, charts, pivots, lists and financial tables — built from typed, whitelisted condition records rather than raw client-supplied queries, so every viewer only ever sees data their own access rights already allow.
- 35 OWL components: grid editor, widget palette, 6 editor panels, 9 filter types, save/template/theme dialogs
Result
Non-technical staff build their own dashboards safely. It's now our largest UI system, and we've since reused the same foundation on our other Odoo platform.
The pattern behind it
Enforce the rule where it can't be walked around
A rule that only lives on a screen can be bypassed by an import, a script or a busy person. We put it in the model: constraints, gates on stage changes, access checks on every data path.
How we think about problemsRecognise any of this?
Most of our work starts with a message that sounds a lot like this one did.