diff --git a/base_user_role_extended/models/ir_model_access.py b/base_user_role_extended/models/ir_model_access.py
index 089cde8..f0ce237 100644
--- a/base_user_role_extended/models/ir_model_access.py
+++ b/base_user_role_extended/models/ir_model_access.py
@@ -1,12 +1,20 @@
 # Copyright 2026 CIT Services
 # License AGPL-3.0 or later (http://www.gnu.org/licenses/agpl).
 
-from odoo import api, models
+from odoo import api, models, tools
 
 
 class IrModelAccess(models.Model):
     _inherit = "ir.model.access"
 
+    @tools.ormcache("self.env.uid", "mode")
+    def _get_allowed_models(self, mode="read"):
+        """
+        Override to enforce exclusive role-based model access.
+        """
+        self = self.with_context(role=True)
+        return super()._get_allowed_models(mode)
+
     # Handle access rights changes from the respective groups,
     # such as create, update, and deletion of access rights
     @api.model_create_multi
diff --git a/base_user_role_extended/models/res_users.py b/base_user_role_extended/models/res_users.py
index 22adc04..69a0f16 100644
--- a/base_user_role_extended/models/res_users.py
+++ b/base_user_role_extended/models/res_users.py
@@ -27,11 +27,12 @@ def set_groups_from_roles(self, force=False):
             return super(ResUsers, users_to_update).set_groups_from_roles(force=force)
         return True
 
-    @tools.ormcache("self.id", "self.env.uid")
+    @tools.ormcache("self.id", "self.env.uid", "self.env.context.get('role')")
     def _get_group_ids(self):
-        if not self.bypass_role_policy:
-            enabled_roles = self._get_enabled_roles()
-            if enabled_roles:
-                groups = enabled_roles.mapped("role_id.group_id")
-                return groups._ids
+        if self.env.context.get("role"):
+            if not self.bypass_role_policy:
+                enabled_roles = self._get_enabled_roles()
+                if enabled_roles:
+                    groups = enabled_roles.mapped("role_id.group_id")
+                    return groups._ids
         return super()._get_group_ids()