---
id: zope-security
version: "8.3"
license: ZPL-2.1
license_treatment: unclear
maintenance: active
---

# zope.security — Zope Security Framework

License: unclear · Maintenance: active · Downloads: 197.3K/mo

## What it is and what it does

zope.security is a declarative security framework for Python that enforces access control policies on objects through permissions and principals. It provides decorators and configuration mechanisms to protect methods and attributes, making it possible to define who can do what with your code's objects without embedding authorization logic throughout your codebase.

The package is part of the Zope ecosystem and integrates deeply with zope.interface, zope.component, and related libraries. It's designed for applications that need fine-grained, policy-driven security—particularly web frameworks and complex object systems where access control must be flexible and centrally managed. The framework has been in production use since 2007 and remains actively maintained.

Use it for:

- Protect methods and attributes in Zope-based web applications with declarative permission checks
- Implement role-based access control (RBAC) where different principals have different permissions on shared objects
- Enforce security policies in content management systems or document repositories with hierarchical object structures
- Audit and control who can access or modify sensitive business logic in multi-tenant applications
- Define security rules centrally rather than scattering authorization checks throughout application code

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides a generic security framework for implementing access control and permission policies on Python objects, with support for principals, permissions, and declarative security checks.

Yes, if you are building a Zope application or a Python system that requires declarative, policy-driven access control on objects. The framework is mature, actively maintained, and has no known vulnerabilities. However, it carries medium install friction and depends on the full Zope ecosystem, so it is best suited to projects already committed to that architecture. For simpler authorization needs or non-Zope frameworks, lighter alternatives may be more practical.

## Install

pip install zope-security
uv add zope-security
poetry add zope-security

## Installing zope.security

Before you install: Medium install friction due to compiled wheels across multiple platforms and Python versions (3.10–3.13+). Active maintenance with recent commits; last release 270 days ago. Depends on six zope ecosystem packages, which may require additional setup in non-zope environments.

License in practice: Licensed under ZPL-2.1 (Zope Public License 2.1), but license treatment is marked unclear in the metadata. Verify compatibility with your project's license requirements before use.

Quickstart:

pip install zope.security

from zope.security.decorator import protected
from zope.security.permission import Permission

@protected(Permission('view'))
def my_protected_function():
    return 'secured'

Requires Python 3.10 or later. Depends on zope.component, zope.interface, zope.location, zope.proxy, zope.schema, and zope.i18nmessageid; these must be available in your environment.

Verify before relying:

- Specific security policy implementation patterns and how they integrate with non-Zope frameworks
- Performance characteristics when securing large object hierarchies
- Compatibility with async/await patterns in modern Python applications

## Package facts

- License: ZPL-2.1 (unclear)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 197.3K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

zope security framework, python access control policies, permission-based authorization, object security decorators, zope principal permissions, declarative security checks, python object protection, access-control, zope-framework, declarative-security

[View on SkillFed](https://skillfed.io/packages/zope-security) · [View on PyPI](https://pypi.org/project/zope-security/)