---
id: oslo-policy
version: "6.0.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# oslo.policy — Oslo Policy library

License: permissive · Maintenance: active · Downloads: 389.8K/mo

## What it is and what it does

oslo.policy is an OpenStack library that provides the core machinery for enforcing role-based access control (RBAC) policies across OpenStack services. It parses policy rules—typically defined in YAML or JSON—and evaluates them at runtime to determine whether a user with a given set of roles and attributes is permitted to perform a specific action. The library integrates with oslo.config for configuration management, oslo.context for request context handling, and stevedore for plugin discovery, making it the standard policy enforcement layer for OpenStack deployments.

The package is designed for operators and developers building or extending OpenStack services. It abstracts the policy decision logic so that each service doesn't have to implement its own RBAC engine, and it provides a consistent way to define and audit access rules across the entire cloud platform.

Use it for:

- Enforce role-based access control in OpenStack service APIs to restrict who can perform admin, member, or reader actions.
- Define and manage fine-grained policies for cloud resource operations (compute, storage, networking) in a centralized, auditable way.
- Extend policy rules with custom attributes and conditions to implement organization-specific access control requirements.
- Integrate policy enforcement into middleware or service decorators to gate API endpoints based on user roles and context.
- Migrate or validate policy rule syntax across different OpenStack service versions and deployments.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

oslo.policy enforces role-based access control (RBAC) policies across OpenStack services by parsing and evaluating policy rules.

Yes, if you are building or operating an OpenStack cloud or service. oslo.policy is the standard RBAC enforcement library for OpenStack and is actively maintained with no known vulnerabilities. It has low install friction and permissive licensing. Not relevant for non-OpenStack projects.

## Install

pip install oslo-policy
uv add oslo-policy
poetry add oslo-policy

## Installing oslo.policy

Before you install: Low install friction; pure Python wheel with no compiled dependencies. Active maintenance status with a release within the last 37 days. Supports current Python versions (3.11–3.14).

License in practice: Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for proprietary OpenStack deployments.

Quickstart:

pip install oslo.policy

from oslo_policy import policy
from oslo_policy import opts

opts.register_opts(policy.policy_opts)
policy.init()

Requires Python 3.11 or later.

Verify before relying:

- Whether the package works standalone or requires a full OpenStack environment to be useful.
- How policy rules are typically authored and where they are stored (file format, location).
- Whether stevedore integration enables plugin-based policy backends or is only for internal extension discovery.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 389.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

RBAC policy enforcement, OpenStack access control, role-based authorization library, policy rule evaluation, oslo policy rules engine, access control middleware, permission enforcement, openstack, rbac, policy-engine

[View on SkillFed](https://skillfed.io/packages/oslo-policy) · [View on PyPI](https://pypi.org/project/oslo-policy/)