pycasbin

What it is and what it does

PyCasbin is an access control library that evaluates authorization decisions by matching requests against configurable policies. It abstracts access control into a CONF file following the PERM metamodel (Policy, Effect, Request, Matchers), allowing you to define and enforce rules without changing code. The library supports multiple models—ACL (basic subject-object-action rules), RBAC (role hierarchies and domain/tenant separation), ABAC (attribute-based matching), and RESTful patterns—making it adaptable to different authorization schemes.

You provide a model configuration that defines how requests are matched against policies, then load or manage policies at runtime. PyCasbin handles the matching logic, role management, and policy persistence, but does not authenticate users or manage the user/role registry itself—those remain your application's responsibility. It supports both synchronous and asynchronous enforcement, built-in operators for pattern matching, and deny-override semantics where explicit denials take precedence.

Use it for:

• Enforce role-based permissions in a web application where users have different roles with different capabilities per resource.
• Implement multi-tenant authorization where the same user has different roles and permissions in different domains or tenants.
• Build RESTful API access control matching HTTP methods and resource paths to user roles and permissions.
• Manage hierarchical role structures where roles inherit permissions from parent roles, reducing policy duplication.
• Enforce attribute-based rules where access depends on resource properties or request context.
• Centralize authorization logic separate from business code so policies can be updated without redeployment.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

PyCasbin enforces access control policies using models like ACL, RBAC, and ABAC, determining whether a subject can perform an action on an object based on configurable rules.

Yes. PyCasbin is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. It is well-suited for projects needing flexible, model-driven access control. Install it if your application requires authorization beyond simple role checks or if you anticipate changing authorization rules frequently.

Install

pycasbin on PyPI

pip install pycasbin

uv add pycasbin

poetry add pycasbin

Installing pycasbin

Before you install

Low install friction with only 2 runtime dependencies (simpleeval and wcmatch). Active maintenance with a recent release on 2026-02-02 and last commit on 2026-08-13; repository shows 1759 stars and is not archived.

License in practice

Licensed under Apache 2.0 (permissive), allowing use in commercial and proprietary projects with minimal restrictions beyond attribution and liability disclaimers.

Quickstart

pip install pycasbin

from pycasbin import Enforcer

enforcer = Enforcer('model.conf', 'policy.csv')
if enforcer.enforce('alice', 'data1', 'read'):
    print('Access allowed')

Requires a model configuration file (model.conf) and policy file (policy.csv) to define access control rules; the library does not generate these automatically.

Verify before relying

• Whether async support (mentioned as available since 1.23.0) is fully stable and production-ready in version 2.8.0.
• Performance characteristics and scalability limits for large policy sets or high-throughput authorization checks.
• Integration patterns and best practices for frameworks beyond the mentioned Django Authorization library.

Package facts

Evidence: pycasbin-2.8.0-py3-none-any.whl

Keywords: casbin, pycasbin, acl, rbac, abac, auth, authz, authorization, access control, permission

Tags

More Security packages