---
id: rules
version: "3.5"
license: MIT
license_treatment: permissive
maintenance: aging
---

# rules — Awesome Django authorization, without the database

License: permissive · Maintenance: aging · Downloads: 563.4K/mo

## What it is and what it does

rules is a lightweight authorization framework that lets you define object-level permissions using predicates—callable functions that return True or False based on user and object state. Instead of storing permissions in a database, you compose predicates using logical operators to build rule sets that determine what actions a user can perform on specific objects. It integrates seamlessly with Django views, templates, and the admin interface, but can also be used standalone in non-Django contexts.

The core idea is simple: predicates are any callable accepting zero to two arguments (typically user and object), and you combine them with operators to express complex authorization logic. You add rules to a rule set, then test them against a user and object to get a boolean result. This approach avoids database queries for permission checks and keeps authorization logic in code where it's easier to version control and reason about.

Use it for:

- Enforce object-level permissions in Django views—e.g., allow users to edit only their own posts or comments
- Build custom authorization logic for REST APIs without storing per-object permissions in the database
- Implement role-based or attribute-based access control using predicates that inspect user roles or object properties
- Test authorization rules in unit tests by composing predicates without needing fixtures or test data
- Protect Django admin actions—e.g., allow deletion only if the user is the object's owner

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

rules provides object-level permission checking for Django applications using rule-based predicates instead of database queries, and can also be used as a standalone predicate framework in other contexts.

Yes, if you need lightweight object-level permissions in Django and prefer logic-based rules over database-backed permissions. The package is stable (Production/Stable status), has no known vulnerabilities, and zero runtime dependencies. However, the aging maintenance status (last release 711 days ago) means you should verify compatibility with your target Django version and be prepared to maintain a fork if critical issues arise.

## Install

pip install rules
uv add rules
poetry add rules

## Installing rules

Before you install: Low install friction with no runtime dependencies. Maintenance status is aging—last release was 711 days ago (2024-09-02), though the repository remains active with recent commits and 1978 stars. Suitable for established projects but check if active maintenance matters for your use case.

License in practice: MIT license permits commercial and private use with minimal restrictions. You must include a copy of the license and copyright notice, but can modify and distribute freely.

Quickstart:

pip install rules

import rules

@rules.predicate
def is_author(user, book):
    return book.author == user

rules.add_rule('can_edit_book', is_author)
rules.test_rule('can_edit_book', user, book)

Requires Python 3.8 or newer. Optional Django integration requires Django 3.2 or newer.

Verify before relying:

- Whether the aging maintenance status (711 days since last release) affects compatibility with current Django versions
- Performance characteristics when evaluating complex predicate graphs at scale

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: aging
- Downloads: 563.4K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django object permissions, rule-based authorization, predicate framework, django access control, permission decorators, decision tree permissions, django authorization without database, django-permissions, authorization, predicate-logic

[View on SkillFed](https://skillfed.io/packages/rules) · [View on PyPI](https://pypi.org/project/rules/)