Security

connect_crm relies on the standard Connect security groups and adds a small set of webhook access rules so that inbound telephony events can create and update leads.

Connect groups

The module does not define new groups. Access to the CRM auto-create settings follows the core convention:

Group On CRM features
connect.group_user (Connect User) Read access, in line with core; sees linked leads/sources on calls per standard CRM rights.
connect.group_admin (Connect Administrator) Full CRUD, including the CRM tab of the settings form.
connect.group_webhook (Connect Webhook) The dedicated identity used by public webhook controllers — see below.

CRM records themselves (crm.lead, utm.source) keep their normal Odoo CRM/UTM access rights; connect_crm only adds telephony fields and behavior on top.

Webhook access rules

security/webhook.xml grants the webhook identity the minimum it needs to journal telephony events into CRM. This is the group carried by the special connect.user_connect_webhook user that public controllers run as.

Model Read Create Write Unlink
crm.lead
mail.alias_domain
crm.stage
crm.team

A matching record rule (crm_lead_webhook_rule) lets the webhook group read, create and write all leads ([(1, '=', 1)]) — it is not scoped to a salesperson, because webhook-driven creation happens before any assignment.

Webhook identity can create leads

The webhook group can create and modify any lead. That is required for telephony-driven lead creation, but it means the webhook credentials must be protected like any other integration secret. Deletion is never granted.