casbin

What it is and what it does

Casbin is an access control library that enforces authorization decisions based on pluggable models (ACL, RBAC, ABAC, RESTful) and policy rules. It evaluates requests in the form of subject-object-action tuples against a configuration-driven policy engine, returning allow or deny decisions. The library does not handle authentication or user management—it assumes those are handled elsewhere—but it manages role hierarchies, policy storage, and rule matching with built-in operators.

You define your access control model in a CONF file using the PERM metamodel (Policy, Effect, Request, Matchers), then load policies from a CSV file or database. For each access attempt, you call enforce() with the relevant parameters, and Casbin evaluates the request against your policies and returns a boolean. It supports both allow and deny rules, role inheritance, domain/tenant isolation, and attribute-based matching.

Use it for:

• Enforce role-based permissions in a web application where users have different roles (admin, editor, viewer) with different resource access levels.
• Implement fine-grained ACL for a REST API, controlling which users can perform which HTTP methods on which resource paths.
• Add attribute-based access control to a multi-tenant SaaS platform, where access decisions depend on resource ownership or other dynamic attributes.
• Manage hierarchical role structures in an enterprise system where roles inherit permissions from parent roles.
• Centralize authorization logic for microservices by using Casbin as a shared policy engine across multiple services.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Casbin enforces access control policies (ACL, RBAC, ABAC) by evaluating requests against a configurable model and policy rules, returning allow or deny decisions.

Yes. Casbin is actively maintained, has no known vulnerabilities, installs with minimal friction, and is widely adopted (top 5000 on PyPI). It solves a real problem—decoupling authorization logic from application code—and supports multiple access control models. Install it if you need flexible, model-driven authorization; skip it if your access control is trivial or if you prefer inline permission checks.

Install

casbin on PyPI

pip install casbin

uv add casbin

poetry add casbin

Installing casbin

Before you install

Low install friction with a single runtime dependency (simpleeval). Active maintenance with recent releases; last commit 2026-08-13 and 1759 repository stars indicate ongoing development.

License in practice

Apache 2.0 is permissive, allowing commercial and private use with minimal restrictions—suitable for most projects.

Quickstart

pip install casbin

import casbin
e = casbin.Enforcer("model.conf", "policy.csv")
if e.enforce("alice", "data1", "read"):
    # access permitted
    pass

Requires a model configuration file (CONF format) and a policy file (CSV format) to define access control rules.

Verify before relying

• Whether async support (mentioned as available since 1.23.0) is production-ready and fully documented.
• Performance characteristics and scalability limits for large policy sets.
• Integration patterns with common Python web frameworks beyond the mentioned Django Authorization.

Package facts

Evidence: casbin-1.43.0-py3-none-any.whl

Keywords: casbin, acl, rbac, abac, auth, authz, authorization, access control, permission

Tags

More Security packages