---
id: casbin
version: "1.43.0"
license: Apache 2.0
license_treatment: permissive
maintenance: active
---

# casbin — An authorization library that supports access control models like ACL, RBAC, ABAC in Python

License: permissive · Maintenance: active · Downloads: 2.8M/mo

## What it is and what it does

Casbin is an access control library that enforces authorization decisions based on pluggable models (ACL, RBAC, ABAC, RESTful) and policy rules. It evaluates requests in the form of subject-object-action tuples against a configuration-driven policy engine, returning allow or deny decisions. The library does not handle authentication or user management—it assumes those are handled elsewhere—but it manages role hierarchies, policy storage, and rule matching with built-in operators.

You define your access control model in a CONF file using the PERM metamodel (Policy, Effect, Request, Matchers), then load policies from a CSV file or database. For each access attempt, you call enforce() with the relevant parameters, and Casbin evaluates the request against your policies and returns a boolean. It supports both allow and deny rules, role inheritance, domain/tenant isolation, and attribute-based matching.

Use it for:

- Enforce role-based permissions in a web application where users have different roles (admin, editor, viewer) with different resource access levels.
- Implement fine-grained ACL for a REST API, controlling which users can perform which HTTP methods on which resource paths.
- Add attribute-based access control to a multi-tenant SaaS platform, where access decisions depend on resource ownership or other dynamic attributes.
- Manage hierarchical role structures in an enterprise system where roles inherit permissions from parent roles.
- Centralize authorization logic for microservices by using Casbin as a shared policy engine across multiple services.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Casbin enforces access control policies (ACL, RBAC, ABAC) by evaluating requests against a configurable model and policy rules, returning allow or deny decisions.

Yes. Casbin is actively maintained, has no known vulnerabilities, installs with minimal friction, and is widely adopted (top 5000 on PyPI). It solves a real problem—decoupling authorization logic from application code—and supports multiple access control models. Install it if you need flexible, model-driven authorization; skip it if your access control is trivial or if you prefer inline permission checks.

## Install

pip install casbin
uv add casbin
poetry add casbin

## Installing casbin

Before you install: Low install friction with a single runtime dependency (simpleeval). Active maintenance with recent releases; last commit 2026-08-13 and 1759 repository stars indicate ongoing development.

License in practice: Apache 2.0 is permissive, allowing commercial and private use with minimal restrictions—suitable for most projects.

Quickstart:

pip install casbin

import casbin
e = casbin.Enforcer("model.conf", "policy.csv")
if e.enforce("alice", "data1", "read"):
    # access permitted
    pass

Requires a model configuration file (CONF format) and a policy file (CSV format) to define access control rules.

Verify before relying:

- Whether async support (mentioned as available since 1.23.0) is production-ready and fully documented.
- Performance characteristics and scalability limits for large policy sets.
- Integration patterns with common Python web frameworks beyond the mentioned Django Authorization.

## Package facts

- License: Apache 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.8M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

access control library python, rbac authorization enforcement, acl policy enforcement, permission management python, attribute-based access control, role-based access control, authorization decision engine, authorization, access-control, policy-engine

[View on SkillFed](https://skillfed.io/packages/casbin) · [View on PyPI](https://pypi.org/project/casbin/)