Odoo 20 Reveals in SF, SAP Fences Its API, OCA Signs Its Commits

• Four companies drew a line around AI agents in 30 days: SAP banned third-party agents from its API, the OCA banned unsupervised ones from its codebase, Shopify made every Liquid storefront agent-callable, and Odoo is opening a read-only door.
• Odoo 20 launches September 2 in San Francisco. Or September 24 in Brussels. Odoo's own website makes the same claim on both event pages and has not reconciled them.
• Fabien previewed the new design on August 19 and it pulled 860 reactions in a day: Material Design icons, grey header, rounded borders, pastel status tags.
• The community finished catching up to 19. The OCA merged 991 pull requests this month and 380 of them were v19 work. Then OWL 3 arrives and invalidates five years of custom JavaScript.
• The app store crossed 83,520 modules, up 3,750 in thirty days. That is about 875 a week, down from roughly 1,220 a week over the prior stretch, the first slowdown since I started counting.
• I will be at Pier 27 on September 2 and 3. Details at the bottom, first round is on me.

Hey there,

Another installment of my semi-regular Odoo ramblings. This email is sent via Odoo, so feel free to opt-out (I won't be offended).

Ten roadshows deep this year, plus Buffalo earlier this month for Odoo's Marketing Academy. That one was a class rather than a roadshow, and I got more out of it than I expected. My takeaways: Buffalo in the Summer is amazing, the lunch at Odoo HQ is solid, and the Odoo'ers in Buffalo are hungry (despite all the food).

Four Companies Drew a Line Around AI Agents. They Drew It in Four Different Places.

In the last thirty days, SAP, the Odoo Community Association, Shopify and Odoo each put in writing what an AI agent is allowed to do inside their system.

No two of them agree.

Read side by side, they map out who thinks an agent is a threat, who is protecting its reviewers, who is quietly wiring it in, and who is starting read-only.

SAP thinks it is a threat. Section 2.2.2 of SAP's API Policy v4/2026 states that SAP APIs may not be used for "interaction or integration with (semi-)autonomous or generative AI systems that plan, select or execute sequences of API calls." There are exactly four endorsed pathways: Joule Agents, the SAP Integration Suite MCP Gateway, Business Data Cloud, and Agent2Agent through the SAP Agent Gateway. Everything else is a policy violation.

The policy landed in April and it is still drawing fire. DSAG, SAP's own German-speaking user group, went public with its objections, and The Register framed it as a lock-in play.

Ray Carnes put it more directly on August 14: "Do SAP customers really need 'permission' to point an AI Agent at their OWN database to plan and execute API calls???"

His closer: "No such restriction over here at #Odoo."

My prediction: they reverse course on this policy in the next 12 months.

The OCA is protecting its reviewers and drawing a line at the pull request. Its new AI contribution policy requires an Assisted-by: trailer on any commit where AI was involved. It is binary, either present or not. AI tools never go in Co-authored-by:, because a tool is not an author. Unsupervised agentic tools are banned outright. "The AI wrote it" is not an acceptable answer during review. Bot-like behavior earns a permanent ban.

The line that matters: "The interaction with the ecosystem, review, discussion, judgement, accountability, must be human."

The OCA, just like a lot of community-based organizations, got pounded by AI contributions - it became too much. As the OCA does, it took action with community input, expect more changes.

Shopify is pushing agentic shopping. On August 3 Shopify shipped WebMCP for Liquid and Hydrogen storefronts, and by August 5 it was live on every Liquid storefront with zero merchant setup. An agent can search your catalog, manage a cart and reach checkout inside the shopper's own browser tab. Practically nothing can call it yet: as of the last independent audit, no mainstream agent client uses WebMCP at all. Shopify wired the socket anyway. Odoo has no equivalent, and if it does not land in 20 it is Odoo 21, a year out. Is that soon enough?

Odoo opened the door with 'read-only'. Nothing about version 20 is official yet, so take the following as partner reporting: Odoo 20 will ship a native /mcp endpoint, Enterprise only, exposing five tools (context, model listing, field inspection, search-and-read, grouped reads), secured by API key, and every one of those tools read-only. Writes are disabled by default. Governance tooling is minimal. We'll see when the final release lands.

The open question for me is whether agents start replacing deterministic automation: server actions, automation rules, scheduled jobs. Another prediction, they won't.

Now the part nobody wrote down.

None of the four documents say who is accountable when the agent is wrong. SAP names endorsed architectures, which is a procurement answer, not a liability answer. Shopify shipped the surface and left the guardrail to the spec committee. Odoo is opening read-only, which is a guardrail by omission rather than by design.

Only the OCA, the volunteer non-profit with no revenue riding on the outcome, actually put a name on the line: "The human contributor is responsible for their contribution in full, however it was produced."

That is what happens when the people writing the policy are the same people who have to review the pull request.

SAP is protecting a moat, the OCA is protecting accountability, Shopify is laying pipe, and Odoo is protecting nothing yet. Read-only is a gift and a deadline at the same time: you have until the write tools ship to decide what your agent is allowed to touch, and nobody is going to make that decision for you.

Odoo 20 Launches in San Francisco. Or Brussels. Odoo's Website Says Both.

Here is the Americas event page, for September 2 and 3 at Pier 27 in San Francisco: attendees get "an exclusive look at the latest version of Odoo, which will be released during the event."

Here is the Brussels event page, for September 24 through 26: attendees get "an exclusive look at the latest version of Odoo, which will be released during the event."

Same sentence. Three weeks apart...?

Odoo's own LinkedIn account broke the tie on August 20, counting down to San Francisco and promising "the exclusive live reveal of Odoo 20." Fabien's opening keynote, meanwhile, is scheduled for Brussels on September 24 at 8:30am.

The scale gap is not close. Brussels expects 45,000+ attendees from 150+ countries across 400+ talks and 400+ exhibitors. San Francisco expects 6,000+ across 100+ talks. Brussels is the franchise. San Francisco has Kara Swisher, Scott Galloway and Jacob Goldstein on the keynote stage, plus three guest slots Odoo has not announced. And, no dear readers, it will not be me on the stage. My talk was rejected.

Fabien posted a side-by-side on August 19 and it drew 860 reactions and 101 comments inside a day, the biggest engagement item I tracked anywhere this month. The changes he listed: Material Design icons replacing Font Awesome, a grey header with white inputs, rounded borders, and pastel colors on tags and status badges. He was careful to add "still a work in progress: final version might change."

It looks less like an ERP and more like software people choose. That is the whole strategy in one screenshot.

If you are in North America and you have spent years treating Brussels as the only event that matters, September 2 is now the date on your calendar. You will see the version three weeks before your European counterparts, and Odoo has left three keynote slots open for a reason.

I will be at Pier 27 on September 2 and 3. The last few of these trips have turned into reunions, which is the best problem to have. If you are going, hit reply to this email or find me on LinkedIn and let's grab time. Same standing offer as Buffalo: first round is on me.

• The community caught up to 19, right on time to be broken by 20. The OCA merged 991 pull requests across 132 repositories this month. 380 carried "19.0" in the title and 195 were straight migration ports, roughly 40% of all merge volume. OpenUpgrade added 87 more on its live 19.0 branch. The "wait for the community to catch up" objection now has an expiry date.

• Then OWL 3 lands. Currently at v3.0.0-alpha.34 and expected to launch with Odoo 20. useState() becomes proxy() and signal(), services become plugins, this.env is removed entirely, t-esc is fully removed in favor of t-out, onWillUpdateProps and useComponent() are gone, and every variable in a QWeb template needs a this. prefix. Every custom JavaScript component you have shipped in five years needs an audit. Two of those fixes are backward compatible with v19, so swap t-esc for t-out and add your this. prefixes now. That work is free today and a blocker in September.

• The app store crossed 83,520 modules, up from 79,770 when I last counted on July 21. That is 3,750 in thirty days, about 875 a week, down from roughly 1,220 a week between May 31 and July 21. First time the rate has dropped since I started tracking it. The obvious explanation is August: the OCA contributor base is heavily European and the continent stops for a month. Worth watching in September before calling it a trend.

• Odoo launched an official accountant network in Germany on August 17. Accounting firms get free centralized dashboard access to their clients' Odoo Online databases plus qualified leads out of Odoo's own customer base. The entry bar is two existing Odoo clients and an application. That is a new channel tier sitting next to yours, and it is cheaper to join than partnership.

• Nine university MOUs in thirty days, five of them in Vietnam. Odoo signed Royal University of Phnom Penh, three Vietnamese universities on August 3 alone, then Hoa Sen and Van Lang. The program terms are free Enterprise databases for 24 months, ready-made curriculum, certification exams and a "class to career" jobs pathway into partners. Certified-developer scarcity is what caps partner margin, and Odoo is manufacturing the supply itself.

• SAP Commerce Cloud shipped a CVSS 10.0. CVE-2026-58231 is an unauthenticated remote code execution in the Data Hub Adapter: the /datahubadapter/import/ endpoint processes data without verifying who is calling. Patched August 11, exploitation attempts observed August 14**. Three days. Affects Commerce Cloud 2211 and 2211-JDK21, fix is SAP Security Note 3771065 plus a redeploy.

• NetSuite started metering AI as a billable unit. The 2026.2 August release moves from ociConfig to "NetSuite AI Units," adds reasoning transparency to Ask Oracle, and ships six new prebuilt skills. Separately, Oracle is putting Google Gemini models into Fusion and NetSuite, reaching 43,000+ NetSuite customers. Odoo's AI stack stays single and opinionated, which is easier to sell and harder to defend when procurement asks "which model?"

• SAP's Q2 Business AI release contains zero Business One content. I checked the primary newsroom post. Joule agents across finance, supply chain, procurement and CX, an ABAP migration agent, Joule Studio for custom agents, and nothing at all for the SMB product. B1's 2026 roadmap is a Fiori web client refresh. That gap is the whole pitch.

• France's e-invoicing mandate starts September 1. Every French company must be able to receive e-invoices, and large and mid-sized firms must issue them. SMEs get until September 2027. The OCA merged Factur-X import improvements and a 16.0 backport on August 20, eleven days out.

• Patch your OCA DMS. dms#505 and #506 merged August 20, scoping directory share tokens to their own subtree. If you run DMS with external sharing, that was a leak.

• On my side: a client complained that quotes were going out under the assigned salesperson's name instead of the actual sender. That turned into an audit of every email template Odoo 19 ships, pulled from a live database rather than the docs. 150+ templates across 50+ modules. The From field is a fallback chain (three steps typically, four in Helpdesk, and about 35 templates have no From field at all). The To field is not a chain at all, it is a Default Recipients checkbox that silently overrides your custom logic, which means the Lazada, Shopee and TikTok connectors carry override fields that never execute. And the Helpdesk "Ticket Closed" template ships {{ object.ticket_ref if object.ticket_ref else 15 }}, a hardcoded 15 that looks like leftover demo data. Three write-ups: From, To, Subject.

See you at Pier 27.

Cheers!

Darren from 19 Prince