casbin
An authorization library that supports access control models like ACL, RBAC, ABAC in Python
Decision gist · record as of 2026-08-14
Yes. Casbin is actively maintained, has no known vulnerabilities, installs with minimal friction, and is widely adopted (top 5000 on PyPI). It solves a real problem—decoupling authorization logic from application code—and supports multiple access control models. Install it if you need flexible, model-driven authorization; skip it if your access control is trivial or if you prefer inline permission checks.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires a model configuration file (CONF format) and a policy file (CSV format) to define access control rules.
- Low install friction with a single runtime dependency (simpleeval).
- Active maintenance with recent releases; last commit 2026-08-13 and 1759 repository stars indicate ongoing development.
License · maintenance · safety
Apache 2.0 (permissive) — Apache 2.0 is permissive, allowing commercial and private use with minimal restrictions—suitable for most projects.
last release 2025-05-10 (461 days) · last repo commit 2026-08-13 · 1,759 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 2,843,231 downloads/mo, #2,865 on PyPI
Alternatives
Verify before relying
pip install casbin
import casbin
e = casbin.Enforcer("model.conf", "policy.csv")
if e.enforce("alice", "data1", "read"):
# access permitted
pass- Whether async support (mentioned as available since 1.23.0) is production-ready and fully documented.
- Performance characteristics and scalability limits for large policy sets.
- Integration patterns with common Python web frameworks beyond the mentioned Django Authorization.
What it is and what it does
Casbin is an access control library that enforces authorization decisions based on pluggable models (ACL, RBAC, ABAC, RESTful) and policy rules. It evaluates requests in the form of subject-object-action tuples against a configuration-driven policy engine, returning allow or deny decisions. The library does not handle authentication or user management—it assumes those are handled elsewhere—but it manages role hierarchies, policy storage, and rule matching with built-in operators.
You define your access control model in a CONF file using the PERM metamodel (Policy, Effect, Request, Matchers), then load policies from a CSV file or database. For each access attempt, you call enforce() with the relevant parameters, and Casbin evaluates the request against your policies and returns a boolean. It supports both allow and deny rules, role inheritance, domain/tenant isolation, and attribute-based matching.
Use it for
- Enforce role-based permissions in a web application where users have different roles (admin, editor, viewer) with different resource access levels.
- Implement fine-grained ACL for a REST API, controlling which users can perform which HTTP methods on which resource paths.
- Add attribute-based access control to a multi-tenant SaaS platform, where access decisions depend on resource ownership or other dynamic attributes.
- Manage hierarchical role structures in an enterprise system where roles inherit permissions from parent roles.
- Centralize authorization logic for microservices by using Casbin as a shared policy engine across multiple services.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
Casbin is actively maintained, has no known vulnerabilities, installs with minimal friction, and is widely adopted (top 5000 on PyPI). It solves a real problem—decoupling authorization logic from application code—and supports multiple access control models. Install it if you need flexible, model-driven authorization; skip it if your access control is trivial or if you prefer inline permission checks.
Install
casbin on PyPI
Before you install
Low install friction with a single runtime dependency (simpleeval). Active maintenance with recent releases; last commit 2026-08-13 and 1759 repository stars indicate ongoing development.
Requires a model configuration file (CONF format) and a policy file (CSV format) to define access control rules.
License in practice
Apache 2.0 is permissive, allowing commercial and private use with minimal restrictions—suitable for most projects.
Quickstart
pip install casbin
import casbin
e = casbin.Enforcer("model.conf", "policy.csv")
if e.enforce("alice", "data1", "read"):
# access permitted
passVerify before relying
- Whether async support (mentioned as available since 1.23.0) is production-ready and fully documented.
- Performance characteristics and scalability limits for large policy sets.
- Integration patterns with common Python web frameworks beyond the mentioned Django Authorization.
Package facts
| License | Apache 2.0 permissive |
| Python support | Supports the current Python release >=3.3 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagesimpleeval |
| Maintenance | Actively maintained 461 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 2,843,231 / month, #2,865 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: Apache Software LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9 |
Evidence: casbin-1.43.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “access control library python”
- casbinCasbin enforces access control policies (ACL, RBAC, ABAC) by…
- google-cloud-access-context-managerPython client library for Google Cloud Access Context Manager,…
- pycasbinPyCasbin enforces access control policies using models like ACL,…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also pycasbin · casbin-sqlalchemy-adapter · casbin-async-sqlalchemy-adapter · sqlalchemy-adapter · cedarpy · auth · oslo.policy · invenio-records-permissions · oso-cloud · winacl