---
id: pycasbin
version: "2.8.0"
license: Apache 2.0
license_treatment: permissive
maintenance: active
---

# pycasbin — An authorization library that supports access control models like ACL, RBAC, ABAC in Python

License: permissive · Maintenance: active · Downloads: 2.1M/mo

## What it is and what it does

PyCasbin is an access control library that evaluates authorization decisions by matching requests against configurable policies. It abstracts access control into a CONF file following the PERM metamodel (Policy, Effect, Request, Matchers), allowing you to define and enforce rules without changing code. The library supports multiple models—ACL (basic subject-object-action rules), RBAC (role hierarchies and domain/tenant separation), ABAC (attribute-based matching), and RESTful patterns—making it adaptable to different authorization schemes.

You provide a model configuration that defines how requests are matched against policies, then load or manage policies at runtime. PyCasbin handles the matching logic, role management, and policy persistence, but does not authenticate users or manage the user/role registry itself—those remain your application's responsibility. It supports both synchronous and asynchronous enforcement, built-in operators for pattern matching, and deny-override semantics where explicit denials take precedence.

Use it for:

- Enforce role-based permissions in a web application where users have different roles with different capabilities per resource.
- Implement multi-tenant authorization where the same user has different roles and permissions in different domains or tenants.
- Build RESTful API access control matching HTTP methods and resource paths to user roles and permissions.
- Manage hierarchical role structures where roles inherit permissions from parent roles, reducing policy duplication.
- Enforce attribute-based rules where access depends on resource properties or request context.
- Centralize authorization logic separate from business code so policies can be updated without redeployment.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

PyCasbin enforces access control policies using models like ACL, RBAC, and ABAC, determining whether a subject can perform an action on an object based on configurable rules.

Yes. PyCasbin is actively maintained, has low install friction, carries no known vulnerabilities, and is licensed permissively. It is well-suited for projects needing flexible, model-driven access control. Install it if your application requires authorization beyond simple role checks or if you anticipate changing authorization rules frequently.

## Install

pip install pycasbin
uv add pycasbin
poetry add pycasbin

## Installing pycasbin

Before you install: Low install friction with only 2 runtime dependencies (simpleeval and wcmatch). Active maintenance with a recent release on 2026-02-02 and last commit on 2026-08-13; repository shows 1759 stars and is not archived.

License in practice: Licensed under Apache 2.0 (permissive), allowing use in commercial and proprietary projects with minimal restrictions beyond attribution and liability disclaimers.

Quickstart:

pip install pycasbin

from pycasbin import Enforcer

enforcer = Enforcer('model.conf', 'policy.csv')
if enforcer.enforce('alice', 'data1', 'read'):
    print('Access allowed')

Requires a model configuration file (model.conf) and policy file (policy.csv) to define access control rules; the library does not generate these automatically.

Verify before relying:

- Whether async support (mentioned as available since 1.23.0) is fully stable and production-ready in version 2.8.0.
- Performance characteristics and scalability limits for large policy sets or high-throughput authorization checks.
- Integration patterns and best practices for frameworks beyond the mentioned Django Authorization library.

## Package facts

- License: Apache 2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

access control library, authorization enforcement, RBAC ABAC ACL, policy-based permissions, role-based access control, attribute-based authorization, permission management, authorization, access-control, policy-engine

[View on SkillFed](https://skillfed.io/packages/pycasbin) · [View on PyPI](https://pypi.org/project/pycasbin/)