---
id: django-guardian
version: "3.3.3"
license: BSD-2-Clause
license_treatment: permissive
maintenance: active
---

# django-guardian — Per object permissions for Django

License: permissive · Maintenance: active · Downloads: 1.1M/mo

## What it is and what it does

django-guardian extends Django's built-in permission system to support per-object (row-level) access control. Instead of granting a user permission to change all instances of a model, you can grant permission to change a specific instance. It works by adding an extra authentication backend and database tables to track object-level grants for users and groups.

The package integrates directly into Django's permission checking—you use the same `has_perm()` method but pass an object instance as a third argument. It also provides admin integration through `GuardedModelAdmin` so you can manage object permissions in the Django admin panel. The library is widely used in production and supports modern Django versions (3.2–5.2) and Python 3.10+.

Use it for:

- Grant specific team members access to edit only their own projects or documents in a multi-tenant app.
- Implement row-level security where users can only view/modify records they own or have been assigned.
- Build admin panels where staff can manage permissions for individual model instances without code changes.
- Control access to sensitive objects (e.g., reports, files) on a per-user or per-group basis within a single model.
- Enforce organizational hierarchies where managers can only access records for their department or team.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

django-guardian adds per-object permission checks to Django, letting you grant or deny specific users and groups access to individual model instances rather than just model-wide permissions.

Yes. django-guardian is a mature, actively maintained library with no known vulnerabilities, low install friction, and permissive licensing. It solves a real problem—per-object permissions—that Django's built-in system does not address. Use it when you need fine-grained access control beyond model-level permissions.

## Install

pip install django-guardian
uv add django-guardian
poetry add django-guardian

## Installing django-guardian

Before you install: Low friction install with only django and typing_extensions as runtime dependencies. The package is actively maintained with a recent release (23 days old) and has been stable since its early releases, supporting Django 3.2 through 5.2 and Python 3.10–3.14.

License in practice: BSD-2-Clause is permissive, allowing commercial use, modification, and distribution with minimal restrictions—suitable for most projects.

Quickstart:

pip install django-guardian

# In settings.py:
INSTALLED_APPS = (..., 'guardian')
AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'guardian.backends.ObjectPermissionBackend',
)

# Then:
from guardian.shortcuts import assign_perm
assign_perm('change_group', user, obj=group_instance)

Requires running `python manage.py migrate` to create guardian database tables after installation.

Verify before relying:

- Performance impact when checking permissions on large numbers of objects or users.
- Compatibility with custom authentication backends beyond those documented.

## Package facts

- License: BSD-2-Clause (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 1.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django per-object permissions, row-level access control django, object-level authorization, django instance permissions, fine-grained django permissions, django object permissions backend, django row permissions, authorization, row-level-security, django-extension

[View on SkillFed](https://skillfed.io/packages/django-guardian) · [View on PyPI](https://pypi.org/project/django-guardian/)