Skip to main content
The HelloLeo AI section of a project decides three things: which agent runs inside the app, who is allowed to talk to it, and what it may do with your data.
Available on Leo Business and above.

​
Attach an agent

Pick one of your agents. Once attached, the agent owns the model, the integrations and the permission rules. The project only decides the audience.

​
Who the assistant is for

Two modes: Own data only filters every request to the signed-in end-user. A customer opening your portal sees their orders, their invoices, their tickets, and nothing else. The filter is applied server-side on every call, so it holds even if someone tampers with the front end. All data returns everything the agent is allowed to read, regardless of who is asking. Use it for internal tools where every user is a colleague.
“Own data only” requires the signed-in session to carry the end-user’s identity. If you expose an app to customers or field staff, this is the setting that keeps one customer from reading another’s records.

​
What the agent may do

Permissions are set per model and per method, not as a blanket read/write switch. For an Odoo project that looks like: Anything not listed is refused. Start from read-only and open writes one model at a time.

​
Why this matters

This is what separates an app you can hand to a customer from a demo. Your ERP roles still apply on top: HelloLeo never grants more than the connection’s own account can do. The permission layer narrows further, per project and per audience.

​
A typical setup

  1. Build a customer portal on Odoo
  2. Create an agent with the Odoo integration, read on orders and invoices, write on tickets
  3. Attach it to the project, set the audience to Own data only
  4. Publish. Each customer signs in and sees only their own records

​
Files the agent can read

The agent chat takes images and PDFs — drag one in, or use the attach button. A PDF goes to the model as it is, so scanned documents and laid-out invoices work; nothing extracts the text beforehand, which is where a text extractor usually fails. The same holds through the API. Alongside your text, send a content block:
Images use the same shape with "type": "image" and their own media type. Spreadsheets are the app’s job. A .csv is already text: read it and send it in the message. An .xlsx is a zip archive no model can read, so parse it in your app first and send the result as text. Leo knows this and will build it that way when you ask for an agent that takes spreadsheets.
Attachments travel inside the request, so they count towards the turn’s tokens. Large documents cost more and, past a few megabytes, are better split.