drf-access-policy

What it is and what it does

drf-access-policy brings declarative, centralized access control to Django REST Framework by letting you define authorization rules in a single policy class per view, modeled after AWS IAM syntax. Instead of scattering permission logic across views and serializers, you write explicit statements that match actions (list, retrieve, publish) to principals (users, groups, anonymous) and effects (allow/deny), making access rules readable to both developers and non-technical stakeholders.

The package also provides FieldAccessMixin to dynamically enforce field-level read-only restrictions based on the same policy, so you can control not just who can call an endpoint but which fields they can modify. The core AccessPolicy class is intentionally small (~150 lines) with no magic, and the library includes complete test coverage. It integrates directly into Django REST Framework's ViewSet permission system.

Use it for:

• Define role-based access control for a REST API where editors can publish articles but regular users can only list and retrieve them.
• Enforce field-level permissions so junior developers can update certain fields but not others (e.g., status fields reserved for admins).
• Centralize authorization logic in one place instead of spreading it across multiple views, making audits and policy changes easier.
• Use reusable custom conditions to share complex permission checks across multiple policies without code duplication.
• Match HTTP methods (POST, PUT, PATCH) directly in action rules to handle different request types with a single statement.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Declares access control rules for Django REST Framework views using an AWS IAM-like policy syntax, with optional field-level permission enforcement through serializer mixins.

Yes, with conditions. The package solves a real problem—centralizing and clarifying access control in Django REST Framework—and the MIT license imposes no restrictions. However, dormancy is a concern: the last release was March 2023 and the project receives no active maintenance. Install it if your Django and DRF versions stay within the supported range (Django 2.0–3.2, Python 3.6–3.11) and you can maintain it yourself if needed. For newer Django/Python versions, verify compatibility before committing.

Install

drf-access-policy on PyPI

pip install drf-access-policy

uv add drf-access-policy

poetry add drf-access-policy

Installing drf-access-policy

Before you install

High install friction: no runtime dependencies listed, but the package is dormant (last release March 2023, last commit August 2024). Supports Python 3.6–3.11 and Django 2.0–3.2, though those Django versions are now outdated. Maintenance signal is weak for a security-adjacent library.

License in practice

MIT license is permissive and imposes no restrictions on use or redistribution, making it safe to adopt in commercial or proprietary projects without compliance burden.

Quickstart

pip install drf-access-policy

from drf_access_policy.access_policy import AccessPolicy

class ArticleAccessPolicy(AccessPolicy):
    statements = [
        {"action": ["list", "retrieve"], "principal": "*", "effect": "allow"},
        {"action": ["publish"], "principal": ["group:editor"], "effect": "allow"}
    ]

Requires Django and Django REST Framework to be installed separately; no runtime dependencies are declared in the package metadata.

Verify before relying

• Whether the package works with Django versions newer than 3.2 (classifiers only list up to 3.2).
• Current compatibility with modern Python 3.12+ given the last release was March 2023.
• Whether field-level permissions work correctly with all serializer types beyond the ModelSerializer example.

Package facts

Evidence: drf-access-policy-1.5.0.tar.gz

Keywords: django, restframework, drf, access, policy, authorization, declaritive

Tags

More Application Frameworks packages