# Self-Hosted Odoo Private AI Layer Blueprint Generator

> Source: https://netray.co/tools/odoo-self-hosted-private-ai-layer-blueprint-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Generate a shareable architecture plan for adding a private, on-prem AI assistant to Self-Hosted Odoo, with components, security controls and a three-phase rollout.

## Category

developer

## Erp

Odoo

## Audience

- CIO
- IT manager
- ERP administrator
- ERP consultant

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Northfield Machining Ltd

#### System version

**Key:** version

**Type:** select

**Options:**

- Odoo 16
- Odoo 17
- Odoo 18
- Odoo 19

**Default:** Odoo 17

#### Database engine

**Key:** db

**Type:** select

**Options:**

- PostgreSQL 13 or 14
- PostgreSQL 15
- PostgreSQL 16 or later
- Not sure

**Default:** PostgreSQL 15

#### Hosting

**Key:** hosting

**Type:** select

**Options:**

- On-prem server
- Private cloud
- Air-gapped network

**Default:** On-prem server

#### Named users

**Key:** users

**Type:** number

**Default:** 80

#### Sites or plants

**Key:** sites

**Type:** number

**Default:** 2

#### Main use cases

**Key:** usecases

**Type:** textarea

**Default:** Manufacturing order status and component shortages. Sales order and delivery questions. Search of vendor documents attached to purchase orders.

#### Data that must never leave the site

**Key:** never

**Type:** textarea

**Default:** Customer pricelists. Employee and payroll data. Controlled drawings.

#### GPU available

**Key:** gpu

**Type:** select

**Options:**

- Not yet purchased
- 1 x 24 GB class GPU
- 1-2 x 48 GB class GPUs
- 2-4 x 80 GB class GPUs
- Existing GPU server

**Default:** 1-2 x 48 GB class GPUs

#### Target go-live

**Key:** golive

**Type:** date

**Default:** 2027-04-30

**Blocks:**

#### Private AI Layer Architecture Plan: Self-Hosted Odoo

**Body:** Company: {{company}}
System and version: Self-Hosted Odoo, {{version}}
Database: {{db}}
Hosting: {{hosting}}
Named users: {{users}}
Sites or plants: {{sites}}
GPU: {{gpu}}
Target go-live: {{golive}}

#### Context and objectives

**Body:** {{company}} wants an AI assistant over its Self-Hosted Odoo data and documents that runs inside its own environment ({{hosting}}). The assistant must answer questions in natural language, show the data behind each answer, respect existing user permissions and remain read-only until approvals are in place.

Main use cases:
{{usecases}}

#### Data boundaries

**Body:** The following data must never leave the site and must stay out of any external service:
{{never}}

All processing, indexing and model inference run on infrastructure controlled by {{company}}.

#### Components

**Table:**

**Columns:**

- Layer
- Design
- Notes for {{company}}

**Rows:**

**0:** Data access path

**1:** External API (XML-RPC, JSON-RPC or the newer JSON API in recent versions) called as the signed-in user so access rights and record rules apply; optional PostgreSQL replica for aggregates only

**2:** Check which endpoints {{version}} supports

**0:** Retrieval index

**1:** Vector index of ir.attachment files and knowledge articles tagged with res_model and res_id; read access to the parent record checked before use

**2:** Filestore location needed from IT

**0:** Model serving

**1:** Open-weight model on vLLM or Ollama sized to {{gpu}}

**2:** Isolated host when hosting is {{hosting}}

**0:** Tool server

**1:** Typed read tools wrapping search_read calls with fixed fields and limits

**2:** Tools respect pagination on large tables

**0:** Identity and permissions

**1:** Per-user API keys; multi-company context passed on every call; no shared admin key

**2:** Direct SQL never used for per-user answers

**0:** Audit

**1:** Append-only log of question, user, model, domain filter and result count

**2:** Reviewed in the pilot

#### Security controls

**Table:**

**Columns:**

- Control
- Implementation
- Driven by

**Rows:**

**0:** Network isolation

**1:** Model, index and tool server in a dedicated zone with no outbound internet route

**2:** Hosting: {{hosting}}

**0:** Data minimisation

**1:** Only approved views and document sets are exposed; excluded data is never indexed

**2:** Data that must never leave the site

**0:** Least privilege

**1:** Read-only service identity; per-user filtering of tool calls

**2:** {{users}} named users

**0:** Model governance

**1:** Open-weight model pinned by version, weights checksummed, updates via change control

**2:** GPU: {{gpu}}

**0:** Audit and retention

**1:** Append-only log of questions, tools, sources and users with an agreed retention period

**2:** Internal audit and compliance

**0:** Write-back control

**1:** No writes in phases 1 and 2; later writes only through supported APIs with named approvers

**2:** Risk appetite of {{company}}

#### Rollout plan

**Table:**

**Columns:**

- Phase
- Scope
- Exit criteria

**Rows:**

**0:** 1. Read-only questions

**1:** Approved views and documents for a pilot group; answers show their sources

**2:** Accuracy sampled by owners; no permission leaks in review; log reviewed weekly

**0:** 2. Drafts

**1:** Assistant drafts emails, summaries and suggested changes for a person to copy

**2:** Users edit less over time; no unreviewed output leaves the system

**0:** 3. Approved actions

**1:** Selected actions executed through supported APIs after human approval

**2:** Approver named per action; rollback tested; go-live target {{golive}}

#### Open questions for IT

**Body:** 1. How fresh must answers be: real time, minutes or daily?
2. Which companies, databases or libraries are in scope across {{sites}} site(s)?
3. Who owns document permissions and how are they mapped to Self-Hosted Odoo roles?
4. Which customisations or custom tables must be exposed?
5. What is the backup, monitoring and patching plan for the GPU host?
6. Who approves any write-back and through which supported interface?
7. Is a pilot group of 10 to 20 users available for phase 1?

#### Approvals

**Signatures:**

- Prepared by
- IT lead
- Security / compliance
- Business sponsor

**Notes:** Starting-point document, not a final design. Confirm table names, interfaces and security behaviour for your exact release with your vendor or implementation partner. Nothing you enter leaves your browser.

## Content

**Intro:** This free generator drafts a private AI architecture plan for self-hosted Odoo. It builds on the external API and record rules, adds attachment retrieval and a local model, and exports a shareable PDF or Word document.

**Sections:**

#### How to use the blueprint

**Body:** Choose your Odoo version, PostgreSQL version and hosting, then list the questions people ask about manufacturing, sales, stock and purchasing. Note any custom modules and the data that must not leave your servers. The plan describes how an assistant authenticates as each user, reads through the ORM, retrieves attachments and calls a local model, with a three-phase rollout.

#### What Odoo specifics it assumes

**Body:** The plan assumes a self-hosted Odoo, because Odoo Online and Odoo.sh are cloud hosted. It relies on the ORM to enforce ir.model.access groups and ir.rule record rules, and on per-user API keys. A PostgreSQL replica is optional and limited to aggregates, because direct SQL bypasses record rules. API endpoints differ by version, so the plan asks IT to confirm which ones apply.

#### Reading the output and common mistakes

**Body:** Use the open questions to confirm multi-company behaviour, custom models and filestore access. Typical mistakes are sharing one administrator key, using SQL for per-user answers, unbounded search_read calls and indexing attachments without checking parent access. Tailor the tool list to the apps you actually run.

**Cta:** If you want help adapting this plan to your Odoo modules and customisations, Netray can review it with you. The tool works without us.

**Faq:**

#### Does this work with Odoo Community?

**Answer:** Yes. The external API exists in Community and Enterprise when self-hosted. The plan lists tools by app, so include only the modules you run.

#### Why per-user API keys?

**Answer:** Calls made with a person's key run through Odoo's ORM as that person, so access rights and record rules apply automatically. A shared admin key would let the assistant show data users cannot normally see.

#### Does it work on Odoo.sh?

**Answer:** The plan targets self-hosted installs. Odoo.sh and Odoo Online are hosted by the vendor or a cloud provider, so a fully on-prem model and index are not the same pattern.

#### Is Odoo's own AI enough?

**Answer:** It might be, depending on version and data policy. This plan is for teams that need data to stay on their servers or want one assistant across Odoo and other sources.

## Search terms

Self-Hosted Odoo AI architecture, Self-Hosted Odoo private AI, Self-Hosted Odoo on-prem AI plan, private AI blueprint ERP, on-prem LLM architecture template, AI architecture document generator, air-gapped AI plan template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json