django-guardian

django-guardian is an implementation of per-object permissions on top of Django’s built-in authorization backend. Where Django’s default permission system works at the model level, django-guardian lets you grant and check permissions for individual object instances — so a user or group can be authorized to edit one specific record without gaining access to all others.

It plugs in as an additional authentication backend and provides shortcuts, decorators, mixins, and admin integration for assigning, removing, and querying object-level permissions. A mature and widely adopted extension, it is the de facto standard for row-level authorization in Django applications.

What You Get

• An object-permissions authentication backend that extends Django’s authorization
• assign_perm and remove_perm shortcuts to grant permissions on specific instances
• Decorators and class-based-view mixins to guard views by object permission
• Django admin integration for managing per-object permissions

Common Use Cases

• Granting a user edit rights to only the specific records they own
• Sharing individual objects with selected users or groups in multi-tenant apps
• Enforcing row-level access control in views and the Django admin

Under The Hood

Architecture - The guardian package registers an app (apps.py) whose backends.py defines ObjectPermissionBackend, added to Django’s AUTHENTICATION_BACKENDS. Per-object grants are persisted through models under models/ and mediated by custom managers.py. The public surface is centralized in shortcuts.py (assign_perm, remove_perm, get_objects_for_user), with decorators.py and mixins.py providing view-level enforcement and admin.py wiring the Django admin. core.py holds the permission-checking logic.

Tech Stack - Pure Python built on the Django framework, packaged via pyproject.toml and tested across Python/Django versions with tox. It ships migrations, locale files, templates, and static assets, and includes a py.typed marker for type checking.

Code Quality - The project reports high test coverage (~97.8%) with an extensive test suite plus benchmarks and example projects. Code is organized by Django convention (models, managers, backends, admin, mixins), and the codebase is mature, actively maintained, and well documented on Read the Docs.

API Design - The shortcuts API keeps the common tasks — assigning, removing, and querying object permissions — to single, clearly named calls, while decorators and mixins mirror Django’s own patterns. Integration requires the standard Django app wiring (INSTALLED_APPS, auth backend, migrations), so the learning curve is modest for developers already comfortable with Django’s permission model.