Execution Layer for Odoo
Evidence and audit.
The immutable audit at the heart of the Execution Layer: before and after snapshots, per-record history, immutability enforced at three levels, alerts that come to you, and the AI-marked notes left on the records themselves.
Every call, whether it succeeds, is refused, or fails, is recorded. The audit answers the one question no prompt can: what did the AI actually do.
Before and after
Every write records before and after snapshots of the fields it touched, and the list of changed fields. Opening the history of a record answers “show everything AI ever did to this customer” in one view, in order, each entry carrying the change, the old and new values, the acting user, and the receipt id.
Written on an independent transaction
The evidence row is written on a database cursor independent of the business transaction. That means
a refusal or a failure is recorded even when the business change rolls back. Denials do not
vanish with the thing they denied. In strict mode, if the audit write itself fails, the call fails
with AUDIT_UNAVAILABLE rather than proceeding unrecorded.
Immutable, enforced three ways
The audit is designed to be tamper-evident even below the ORM:
- An ORM guard blocks edits and deletes of audit records through Odoo.
- A PostgreSQL trigger on update and delete rejects changes at the database level; its only sanctioned bypass is the retention cron.
- A per-row hash chain means that tampering underneath the ORM, through raw SQL or a server action, is at least evident.
Disabling the audit is itself an audited security action.
These are in the test suite
The adversarial suite actively tries to tamper with
the audit through sudo(), raw SQL, and server actions, and asserts that the guards
hold. You can run those cases on your own staging.
Alerts that come to you
An audit nobody opens is not much use. Alert rules watch the log and route what matters to the right person, over email, a webhook, or an Odoo activity. Sensible defaults ship on: a denied high-risk action raises an activity; a burst of denials in a short window raises an email or a webhook. It is a log that finds you, not a log you have to remember to read.
The dashboard
The app opens on an evidence dashboard: today’s actions, refusals broken down by code, failures, pending approvals, and fired alerts, with the latest actions feed and their outcomes.
Notes on the record itself
When AI edits a business record, the pipeline leaves a marked note in that record’s Odoo chatter, so the change is visible to the people who work that record every day, not only in the Execution Layer app.
Off-site mirror (at launch)
A premium add-on, packaged at launch, mirrors the immutable audit to a customer-owned destination such as S3 Object Lock, Azure immutable blob, or a SIEM. The audit stays yours, and a second copy lives somewhere the same admin cannot quietly change.