AccessControl
Security framework for Zope
Decision gist · record as of 2026-08-14
Yes, if you are building or maintaining a Zope application. AccessControl is the standard security framework for Zope and is actively maintained with recent security fixes. The 17 runtime dependencies are expected in a Zope environment. No known vulnerabilities as of the fact sheet. Not recommended outside Zope ecosystems—it is tightly coupled to Zope's object model and has no standalone use case.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later; depends on a full Zope environment with ExtensionClass, Acquisition, and other Zope packages installed.
- Medium install friction due to 17 runtime dependencies including Zope ecosystem packages (Acquisition, ExtensionClass, Persistence, BTrees, zope.security, zope.component).
- Active maintenance with recent release (32 days ago) and support for Python 3.10–3.14.
License · maintenance · safety
ZPL-2.1 (unclear) — Licensed under ZPL-2.1 (Zope Public License 2.1), a permissive open-source license compatible with GPL. License treatment is marked unclear in the fact sheet; verify specific terms if proprietary use is a concern.
last release 2026-07-13 (32 days) · last repo commit 2026-07-13 · 15 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 196,584 downloads/mo, #9,778 on PyPI
Alternatives
Verify before relying
from AccessControl import getSecurityManager
from AccessControl.SecurityManagement import newSecurityManager
# Set up a security context
newSecurityManager(None, user_object)
manager = getSecurityManager()- Whether the C implementation is automatically selected or requires explicit configuration beyond PURE_PYTHON environment variable.
- Performance characteristics and overhead of guarded attribute access compared to unrestricted access in typical Zope applications.
- Scope and impact of the GHSA-g5vw-3h65-2q3v UserFolder.data access fix in version 7.2.
What it is and what it does
AccessControl is a security framework for Zope that enforces fine-grained access control through guarded attribute access, role-based permissions, and authorization checks. It sits between application code and object attributes, validating whether a user has permission to access or modify data based on declared roles and security policies. The package provides both Python and C implementations of core security functions (like guarded_getattr), with the C version used by default for performance.
The framework integrates deeply with Zope's object model through Acquisition and ExtensionClass, allowing security declarations to be inherited and composed across object hierarchies. It manages user folders, role definitions, permission mappings, and restricted code execution (via RestrictedPython). Recent versions have addressed parity issues between Python and C implementations and fixed information-disclosure vulnerabilities in string formatting and UserFolder data access.
Use it for
- Enforce role-based access control in Zope-based web applications where different users need different permissions to view or modify objects.
- Prevent untrusted code or user-supplied scripts from accessing sensitive attributes or methods through guarded attribute validation.
- Define and manage hierarchical permission and role systems across complex object graphs in Zope content management systems.
- Restrict access to built-in methods and attributes on basic types (strings, bytes, ranges) to prevent information leakage in restricted execution contexts.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are building or maintaining a Zope application.
AccessControl is the standard security framework for Zope and is actively maintained with recent security fixes. The 17 runtime dependencies are expected in a Zope environment. No known vulnerabilities as of the fact sheet. Not recommended outside Zope ecosystems—it is tightly coupled to Zope's object model and has no standalone use case.
Install
accesscontrol on PyPI
Before you install
Medium install friction due to 17 runtime dependencies including Zope ecosystem packages (Acquisition, ExtensionClass, Persistence, BTrees, zope.security, zope.component). Active maintenance with recent release (32 days ago) and support for Python 3.10–3.14.
Requires Python 3.10 or later; depends on a full Zope environment with ExtensionClass, Acquisition, and other Zope packages installed.
License in practice
Licensed under ZPL-2.1 (Zope Public License 2.1), a permissive open-source license compatible with GPL. License treatment is marked unclear in the fact sheet; verify specific terms if proprietary use is a concern.
Quickstart
from AccessControl import getSecurityManager
from AccessControl.SecurityManagement import newSecurityManager
# Set up a security context
newSecurityManager(None, user_object)
manager = getSecurityManager()Verify before relying
- Whether the C implementation is automatically selected or requires explicit configuration beyond PURE_PYTHON environment variable.
- Performance characteristics and overhead of guarded attribute access compared to unrestricted access in typical Zope applications.
- Scope and impact of the GHSA-g5vw-3h65-2q3v UserFolder.data access fix in version 7.2.
Package facts
| License | ZPL-2.1 unclear |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Medium. Platform-specific wheel |
| Runtime dependencies | 17 packagesAcquisitionAuthEncodingBTreesDateTimeExtensionClassPersistenceRestrictedPythontransactionzExceptionszope.componentzope.configurationzope.deferredimportzope.interfacezope.publisherzope.schemazope.securityzope.testing |
| Maintenance | Actively maintained 32 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 196,584 / month, #9,778 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 6 - MatureEnvironment :: Web EnvironmentFramework :: ZopeFramework :: Zope :: 5Operating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: Implementation :: CPython |
Evidence: accesscontrol-7.4-cp310-cp310-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp310-cp310-macosx_11_0_arm64.whl; accesscontrol-7.4-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp310-cp310-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp310-cp310-win_amd64.whl; accesscontrol-7.4-cp311-cp311-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp311-cp311-macosx_11_0_arm64.whl; accesscontrol-7.4-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp311-cp311-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp311-cp311-win_amd64.whl; accesscontrol-7.4-cp311-cp311-win_arm64.whl; accesscontrol-7.4-cp312-cp312-macosx_10_9_x86_64.whl; accesscontrol-7.4-cp312-cp312-macosx_11_0_arm64.whl; accesscontrol-7.4-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; accesscontrol-7.4-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; accesscontrol-7.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; accesscontrol-7.4-cp312-cp312-win_amd64.whl; accesscontrol-7.4-cp312-cp312-win_arm64.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “zope security framework”
- AccessControlAccessControl provides a security framework for Zope that enforces…
- ZopeZope is an open-source web application server and framework that…
- zope.securityProvides a generic security framework for implementing access control…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also zope.proxy · zope.security · RestrictedPython · zExceptions · AuthEncoding · zope.configuration · azure-synapse-accesscontrol · landlock · zope.container · zope.browserpage