zope.security

What it is and what it does

zope.security is a declarative security framework for Python that enforces access control policies on objects through permissions and principals. It provides decorators and configuration mechanisms to protect methods and attributes, making it possible to define who can do what with your code's objects without embedding authorization logic throughout your codebase.

The package is part of the Zope ecosystem and integrates deeply with zope.interface, zope.component, and related libraries. It's designed for applications that need fine-grained, policy-driven security—particularly web frameworks and complex object systems where access control must be flexible and centrally managed. The framework has been in production use since 2007 and remains actively maintained.

Use it for:

• Protect methods and attributes in Zope-based web applications with declarative permission checks
• Implement role-based access control (RBAC) where different principals have different permissions on shared objects
• Enforce security policies in content management systems or document repositories with hierarchical object structures
• Audit and control who can access or modify sensitive business logic in multi-tenant applications
• Define security rules centrally rather than scattering authorization checks throughout application code

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a generic security framework for implementing access control and permission policies on Python objects, with support for principals, permissions, and declarative security checks.

Yes, if you are building a Zope application or a Python system that requires declarative, policy-driven access control on objects. The framework is mature, actively maintained, and has no known vulnerabilities. However, it carries medium install friction and depends on the full Zope ecosystem, so it is best suited to projects already committed to that architecture. For simpler authorization needs or non-Zope frameworks, lighter alternatives may be more practical.

Install

zope-security on PyPI

pip install zope-security

uv add zope-security

poetry add zope-security

Installing zope.security

Before you install

Medium install friction due to compiled wheels across multiple platforms and Python versions (3.10–3.13+). Active maintenance with recent commits; last release 270 days ago. Depends on six zope ecosystem packages, which may require additional setup in non-zope environments.

License in practice

Licensed under ZPL-2.1 (Zope Public License 2.1), but license treatment is marked unclear in the metadata. Verify compatibility with your project's license requirements before use.

Quickstart

pip install zope.security

from zope.security.decorator import protected
from zope.security.permission import Permission

@protected(Permission('view'))
def my_protected_function():
    return 'secured'

Requires Python 3.10 or later. Depends on zope.component, zope.interface, zope.location, zope.proxy, zope.schema, and zope.i18nmessageid; these must be available in your environment.

Verify before relying

• Specific security policy implementation patterns and how they integrate with non-Zope frameworks
• Performance characteristics when securing large object hierarchies
• Compatibility with async/await patterns in modern Python applications

Package facts

Evidence: zope_security-8.3-cp310-cp310-macosx_10_9_x86_64.whl; zope_security-8.3-cp310-cp310-macosx_11_0_arm64.whl; zope_security-8.3-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; zope_security-8.3-cp310-cp310-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; zope_security-8.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; zope_security-8.3-cp310-cp310-win_amd64.whl; zope_security-8.3-cp311-cp311-macosx_10_9_x86_64.whl; zope_security-8.3-cp311-cp311-macosx_11_0_arm64.whl; zope_security-8.3-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; zope_security-8.3-cp311-cp311-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; zope_security-8.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; zope_security-8.3-cp311-cp311-win_amd64.whl; zope_security-8.3-cp312-cp312-macosx_10_9_x86_64.whl; zope_security-8.3-cp312-cp312-macosx_11_0_arm64.whl; zope_security-8.3-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl; zope_security-8.3-cp312-cp312-manylinux1_x86_64.manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_5_x86_64.whl; zope_security-8.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; zope_security-8.3-cp312-cp312-win_amd64.whl; zope_security-8.3-cp313-cp313-macosx_10_9_x86_64.whl; zope_security-8.3-cp313-cp313-macosx_11_0_arm64.whl

Keywords: zope, security, policy, principal, permission

Tags

More WWW/HTTP packages