django-guardian

What it is and what it does

django-guardian extends Django's built-in permission system to support per-object (row-level) access control. Instead of granting a user permission to change all instances of a model, you can grant permission to change a specific instance. It works by adding an extra authentication backend and database tables to track object-level grants for users and groups.

The package integrates directly into Django's permission checking—you use the same `has_perm()` method but pass an object instance as a third argument. It also provides admin integration through `GuardedModelAdmin` so you can manage object permissions in the Django admin panel. The library is widely used in production and supports modern Django versions (3.2–5.2) and Python 3.10+.

Use it for:

• Grant specific team members access to edit only their own projects or documents in a multi-tenant app.
• Implement row-level security where users can only view/modify records they own or have been assigned.
• Build admin panels where staff can manage permissions for individual model instances without code changes.
• Control access to sensitive objects (e.g., reports, files) on a per-user or per-group basis within a single model.
• Enforce organizational hierarchies where managers can only access records for their department or team.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

django-guardian adds per-object permission checks to Django, letting you grant or deny specific users and groups access to individual model instances rather than just model-wide permissions.

Yes. django-guardian is a mature, actively maintained library with no known vulnerabilities, low install friction, and permissive licensing. It solves a real problem—per-object permissions—that Django's built-in system does not address. Use it when you need fine-grained access control beyond model-level permissions.

Install

django-guardian on PyPI

pip install django-guardian

uv add django-guardian

poetry add django-guardian

Installing django-guardian

Before you install

Low friction install with only django and typing_extensions as runtime dependencies. The package is actively maintained with a recent release (23 days old) and has been stable since its early releases, supporting Django 3.2 through 5.2 and Python 3.10–3.14.

License in practice

BSD-2-Clause is permissive, allowing commercial use, modification, and distribution with minimal restrictions—suitable for most projects.

Quickstart

pip install django-guardian

# In settings.py:
INSTALLED_APPS = (..., 'guardian')
AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'guardian.backends.ObjectPermissionBackend',
)

# Then:
from guardian.shortcuts import assign_perm
assign_perm('change_group', user, obj=group_instance)

Requires running `python manage.py migrate` to create guardian database tables after installation.

Verify before relying

• Performance impact when checking permissions on large numbers of objects or users.
• Compatibility with custom authentication backends beyond those documented.

Package facts

Evidence: django_guardian-3.3.3-py3-none-any.whl

Keywords: django, permissions, authorization, object, row, level

Tags

More Python Modules packages