rules

What it is and what it does

rules is a lightweight authorization framework that lets you define object-level permissions using predicates—callable functions that return True or False based on user and object state. Instead of storing permissions in a database, you compose predicates using logical operators to build rule sets that determine what actions a user can perform on specific objects. It integrates seamlessly with Django views, templates, and the admin interface, but can also be used standalone in non-Django contexts.

The core idea is simple: predicates are any callable accepting zero to two arguments (typically user and object), and you combine them with operators to express complex authorization logic. You add rules to a rule set, then test them against a user and object to get a boolean result. This approach avoids database queries for permission checks and keeps authorization logic in code where it's easier to version control and reason about.

Use it for

• Enforce object-level permissions in Django views—e.g., allow users to edit only their own posts or comments
• Build custom authorization logic for REST APIs without storing per-object permissions in the database
• Implement role-based or attribute-based access control using predicates that inspect user roles or object properties
• Test authorization rules in unit tests by composing predicates without needing fixtures or test data
• Protect Django admin actions—e.g., allow deletion only if the user is the object's owner

Worth the install?

AI-flagged interpretation of the facts on this page. Verify before relying on it.

Install

rules on PyPI

Before you install

Low install friction with no runtime dependencies. Maintenance status is aging—last release was 711 days ago (2024-09-02), though the repository remains active with recent commits and 1978 stars. Suitable for established projects but check if active maintenance matters for your use case.

Requires Python 3.8 or newer. Optional Django integration requires Django 3.2 or newer.

License in practice

MIT license permits commercial and private use with minimal restrictions. You must include a copy of the license and copyright notice, but can modify and distribute freely.

Quickstart

pip install rules

import rules

@rules.predicate
def is_author(user, book):
    return book.author == user

rules.add_rule('can_edit_book', is_author)
rules.test_rule('can_edit_book', user, book)

Package facts

Evidence: rules-3.5-py2.py3-none-any.whl

Tags

More Application Frameworks packages

See also bridgekeeper · skope-rules · dry-rest-permissions · business-rules · zope.security · django-guardian · bddl · django-prbac · djangorestframework-guardian