Ir al contenido

Odoo 20 AI agents can change your data: who approves what they do?

1 de octubre de 2026 por
Serhii Chebyshev

The assistant that answered questions now edits your records

In Odoo 19, AI mostly answered and summarised. In Odoo 20, agents can create and update records, run as part of automated and scheduled actions, and work through files you upload. Odoo's own demo shows an order arriving by email: one instruction to the agent creates the sales order, sends the customer a confirmation and flags the order for review.

That is useful, and it changes the kind of question a company has to answer. With a chatbot, the question was whether the answer was correct. With an agent that writes to the database, the question is who authorised the action, who checks it and how it gets reversed.

Odoo gives you the controls to build those answers: you can review an agent's automation chats and ask for changes. It cannot decide the policy for you. Which orders the agent may create without a person looking, which customers it may email, and who answers when it gets one wrong are business decisions, and they belong to people with the authority to make them.

This article describes the four decisions to make before the first agent goes live, a way to match autonomy to risk, and three processes that are reasonable places to start.


What Odoo 20 agents can do, and what the release notes leave open

The features that matter for governance, as described in Odoo's Odoo 20 material and in partner summaries of the release:

  • Agents can be triggered by automated and scheduled actions, so they handle parts of a process in the background.
  • Agents can create and update records, for example from a PDF with instructions.
  • Agents show live updates on what they are doing and ask for permission or answers with a single click.
  • You can review automation chats to see how an agent handled a task and ask for changes if something went wrong.
  • Agents can update themselves to fit their use case.
  • The instruction sets that define an agent's behaviour are now called skills.
  • You can describe a process in plain language and the agent sets up the automation. According to Odoo's demo, the agent explains what it will do before the process goes live.
  • External AI tools can connect to your database over MCP, the Model Context Protocol. According to Odoo, the connection reads and writes data within the access rights of the user.
  • All AI features require credits bought as in app purchases.

Three points deserve attention because the public material does not settle them.

The first is identity. When an agent runs from a scheduled action at night, whose access rights apply? The MCP description says the connection respects the access rights of the user. Check how the same principle applies to agents inside automations before you rely on it.

The second is self modification. An agent that can update itself can change the instructions you approved. Decide who reviews those changes, and how often.

The third is the combination with Odoo 20's access rights rewrite. Record rules have been removed, and a domain can now be set directly on an access right. If an agent acts within a user's rights, the quality of those rights now sets the limit of what the agent can touch.


Four decisions to make before the first agent goes live

An agent automates the process you describe to it, whether that description is good or bad. If two people in your company handle the same type of order differently, the agent will pick one way or invent a third. These four decisions turn a vague wish into an instruction an agent can follow.

1. Name one owner for each agent

Every agent needs a person who is accountable for what it does, in the same way a team lead is accountable for a new hire. The owner approves the instructions, reads the exceptions and decides when the agent gets more freedom. Without a named owner, an error becomes a discussion between sales, finance and IT about whose problem it is.

2. Define what the agent may write

List the models and fields the agent can create or change, and the ones it must never touch. Creating a draft sales order is a different act from confirming it, and sending a customer a confirmation is different again. Write the boundary at the level of the action, because that is where the cost of a mistake changes. Prices, payment terms, bank details and customer master data deserve a separate line each.

3. Decide when a person looks

There are three options: before the action takes effect, after it on a sample, or only when something is flagged. Choose per action, not per agent. The Odoo demo flags the order for review after the agent creates it, which is one reasonable pattern for orders and a poor one for anything that leaves the company, such as a payment.

A review only works if someone has time for it. If the owner receives forty flagged records a day and approves them without reading, the review exists on paper only.

4. Decide how a wrong action is undone

For each action the agent can take, write down who notices a mistake, how they find the affected records and how they reverse them. A draft quotation can be deleted. A confirmed order that triggered a purchase and a customer email cannot be undone with one click. If you cannot describe the way back, the agent should not take that action alone yet.


Match autonomy to the cost of a mistake

The four levels below are a working framework we use when planning agent processes. They are not Odoo settings. You build each level from the agent, automated action and access right options Odoo provides.

Level

What the agent does

Who checks

Suits

1. Read and answer

Reads records and reports, answers questions, writes nothing

Nobody, the user judges the answer

Cash and receivables questions, stock lookups, summaries

2. Draft

Creates draft records and proposals, never confirms or sends

A person before anything is confirmed

Quotations from emails, vendor bills from PDFs, project setup from a statement of work

3. Act and flag

Completes a defined action and flags the result for review

A person afterwards, on every record or a sample

Sales orders from known customers, task creation, lead assignment

4. Act alone

Completes the action and reports exceptions only

The owner, on a regular review of exceptions

Repetitive low value actions with a simple way back

Choose the level with one question: if this action is wrong and nobody notices for a week, what does it cost? A wrong internal task costs a few minutes. A wrong price on a confirmed order costs margin. A wrong bank detail on a vendor costs money you may not get back.

Start every new agent one level lower than you think it deserves, and move it up after you have read its results for several weeks. Moving up is a decision for the owner, taken from evidence in the automation chats, not from a feeling that the agent seems reliable.


Three processes that suit a first agent, and three to keep away from it

Good first processes are frequent, well defined and cheap to reverse. Odoo's own demos point to several of them.

Orders that arrive by email

This is the example in Odoo's video, and it fits level 2 or 3. The agent creates the sales order from the email, and a person confirms it or reviews it afterwards. Before you start, agree what the agent does with an unknown customer, a product it cannot match and a price that differs from the price list. Those three cases are where an unclear process becomes a wrong order.

Project setup from a signed document

Odoo 20 lets an agent create records from an uploaded PDF, and partner material describes uploading a proposal or statement of work to set up a project. The agent drafts tasks and milestones, and the project manager edits them. The value is the first draft, and a draft is cheap to correct.

Questions about receivables and cash

The accounting agent answers questions from your reports and, in Odoo's video, reviews a suspected bank reconciliation error and returns recommendations. This is level 1: the agent reads and advises, and the accountant acts. It is the safest way for a finance team to see what agents do with their data.

Processes to keep away from agents for now

  • Anything that moves money, such as paying bills or changing bank details, until you have run the process at level 2 for a full month end.
  • Anything that changes master data used by many processes, such as customer records, price lists and chart of accounts structure.
  • Any process your own team cannot describe in one page. If the humans disagree about the steps, the agent has nothing consistent to follow.

The last point is the one that decides most projects. Writing the process down for an agent is the same work as writing it down for a new employee, and many companies find that the written version exposes the disagreements they have been working around for years.


Test the agent on a copy before it touches production

An agent that behaves well on three examples can still fail on the fourth. Test it on a copy of your database, with real records from last month, before you switch it on.

  1. Pick twenty real cases for the process, and include the awkward ones: the unknown customer, the missing field, the order that arrives twice.
  2. Run the agent on all twenty and read each automation chat to see what it decided and why.
  3. Mark every result as correct, correct but for the wrong reason, or wrong. The second category matters, because those results fail when the data changes.
  4. Change the instructions for each wrong result, run the cases again and keep the earlier cases in the set.
  5. Check what the agent could do with the user rights it runs under, not only what it did. An agent that never touched prices in testing but could have is a risk you should close in the access rights.

One cost belongs in the plan before any of this: all AI features in Odoo 20 require credits, and every test run uses them. Count the test runs and the expected monthly volume before you decide which processes deserve an agent.


 



Contact Us

We'd love to hear from you! Whether you have questions, feedback, or need support, our team is here to help. Simply fill out the form below, and we aim to respond to all inquiries within 24 hours. Thank you for getting in touch!

Compartir esta publicación
Etiquetas