Access reviews that are actually enforced
Run periodic recertification campaigns, catch segregation-of-duties conflicts, and generate audit-ready evidence — with every revocation genuinely removed from the user, not just logged.
The problem
Security groups pile up as employees change roles, join projects, or leave, creating permission creep that violates least-privilege and exposes your company to fraud, data leakage, and failed audits. Most teams review access in spreadsheets and email threads, which capture a decision but never prove it was carried out — leaving the gap between deciding to revoke access and actually removing it wide open.
The solution
Access Review & Recertification runs structured campaigns straight from your live security configuration: reviewers keep or revoke each group with a mandatory justification, revocations are genuinely enforced on the user record, and every decision is captured with a full audit trail and an exportable certification report auditors can act on.
Everything a recertification campaign needs
Every capability below is implemented in the module.
Auto-generated campaigns
Campaigns build their review items automatically from every user’s current security groups, so reviewers never start from a blank spreadsheet.
Genuine enforcement
A revoke decision actually removes the group from the user — not just a logged intention — closing the gap between deciding and doing.
Mandatory justification
Every keep or revoke decision requires a written justification, captured as durable evidence for auditors.
Segregation-of-duties conflicts
Configurable conflict rules flag users holding mutually incompatible group pairs, surfaced inline on the affected review item.
Recurring schedules
Set a cadence once and quarterly or annual recertification campaigns launch automatically, pre-populated and ready to review.
Overdue escalation
Overdue items remind the assigned reviewer and escalate to a compliance owner after a configurable delay, so reviews never silently stall.
Bulk apply revocations
Execute every approved revocation for a campaign in a single action instead of processing items one by one.
Exportable certification report
Generate a sign-off-ready QWeb report on demand, documenting who certified the review and what changed.
Campaign dashboard
See pending, approved, and revoked counts alongside completion rate, with overdue items one click away.
How it works
Launch a campaign
Start manually or let a recurring schedule generate one, auto-populated from current security groups.
Review each item
See guidance on what the group grants and any flagged conflicts, then keep or revoke with a justification.
Apply revocations
Bulk-apply approved revocations — access is genuinely removed from the user record.
Certify and export
Close the campaign and generate the certification report as your audit evidence.
Frequently asked
No sales fog. If your question isn't here, email us and we'll answer it the same way.
Yes. A revoke decision genuinely unlinks the security group from the user’s record — it is not just a logged intention. You can bulk-apply every approved revocation for a campaign in one action.
Buy it on the Odoo App Store
Purchase, download and install directly from the official Odoo Apps Store — you'll always get the latest supported build.
User Access Review & Recertification
Auto-generated recertification campaigns with mandatory justification and revocations that are actually enforced — with segregation-of-duties conflicts, recurring schedules and exportable certification reports.
Buy on Odoo App Store