AccessControl

What it is and what it does

AccessControl is a security framework for Zope that enforces fine-grained access control through guarded attribute access, role-based permissions, and authorization checks. It sits between application code and object attributes, validating whether a user has permission to access or modify data based on declared roles and security policies. The package provides both Python and C implementations of core security functions (like guarded_getattr), with the C version used by default for performance.

The framework integrates deeply with Zope's object model through Acquisition and ExtensionClass, allowing security declarations to be inherited and composed across object hierarchies. It manages user folders, role definitions, permission mappings, and restricted code execution (via RestrictedPython). Recent versions have addressed parity issues between Python and C implementations and fixed information-disclosure vulnerabilities in string formatting and UserFolder data access.

Use it for:

• Enforce role-based access control in Zope-based web applications where different users need different permissions to view or modify objects.
• Prevent untrusted code or user-supplied scripts from accessing sensitive attributes or methods through guarded attribute validation.
• Define and manage hierarchical permission and role systems across complex object graphs in Zope content management systems.
• Restrict access to built-in methods and attributes on basic types (strings, bytes, ranges) to prevent information leakage in restricted execution contexts.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

AccessControl provides a security framework for Zope that enforces access control and authorization rules through guarded attribute access and role-based permission checking.

Yes, if you are building or maintaining a Zope application. AccessControl is the standard security framework for Zope and is actively maintained with recent security fixes. The 17 runtime dependencies are expected in a Zope environment. No known vulnerabilities as of the fact sheet. Not recommended outside Zope ecosystems—it is tightly coupled to Zope's object model and has no standalone use case.

Install

accesscontrol on PyPI

pip install accesscontrol

uv add accesscontrol

poetry add accesscontrol

Installing AccessControl

Before you install

Medium install friction due to 17 runtime dependencies including Zope ecosystem packages (Acquisition, ExtensionClass, Persistence, BTrees, zope.security, zope.component). Active maintenance with recent release (32 days ago) and support for Python 3.10–3.14.

License in practice

Licensed under ZPL-2.1 (Zope Public License 2.1), a permissive open-source license compatible with GPL. License treatment is marked unclear in the fact sheet; verify specific terms if proprietary use is a concern.

Quickstart

from AccessControl import getSecurityManager
from AccessControl.SecurityManagement import newSecurityManager

# Set up a security context
newSecurityManager(None, user_object)
manager = getSecurityManager()

Requires Python 3.10 or later; depends on a full Zope environment with ExtensionClass, Acquisition, and other Zope packages installed.

Verify before relying

• Whether the C implementation is automatically selected or requires explicit configuration beyond PURE_PYTHON environment variable.
• Performance characteristics and overhead of guarded attribute access compared to unrestricted access in typical Zope applications.
• Scope and impact of the GHSA-g5vw-3h65-2q3v UserFolder.data access fix in version 7.2.

Package facts

Evidence: accesscontrol-7.4-cp310-cp310-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp310-cp310-macosx_11_0_arm64.whl; accesscontrol-7.4-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp310-cp310-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp310-cp310-win_amd64.whl; accesscontrol-7.4-cp311-cp311-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp311-cp311-macosx_11_0_arm64.whl; accesscontrol-7.4-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp311-cp311-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp311-cp311-win_amd64.whl; accesscontrol-7.4-cp311-cp311-win_arm64.whl; accesscontrol-7.4-cp312-cp312-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp312-cp312-macosx_11_0_arm64.whl; accesscontrol-7.4-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp312-cp312-win_amd64.whl; accesscontrol-7.4-cp312-cp312-win_arm64.whl

Keywords: security, access, authorization

Tags

More Security packages