django-trusts is a Django permission system for object-level authorization.
It integrates with Django's authentication backend interface, allowing
applications to use familiar checks such as
user.has_perm(permission, object) while defining authorization policies
with ordinary Django models.
A trust model is the application-owned Django model from which three authorization paths begin:
- user — who is requesting access;
- permission — the operation being requested; and
- content — the object being protected.
Each matching trust record is a candidate grant. A trust model is often an explicit many-to-many relation model, but it may represent another relational shape. More than one complete trust may reach the same protected model; each is an alternative grant and the branches combine with OR.
django-trusts supplies the compiler and authorization APIs. It does not impose a permission schema, grant editor, or application workflow.
Start with Installation in the usage guide.
The RST guide covers models, backend configuration, trust registration
(both one-argument path lambdas and Django __ strings,
shown together),
named filters, object and queryset authorization, and inherited relationships.
- Security audit guide
- Migration boundary
- Supported Python, Django, and database combinations
- Development and contribution guide
- BSD 2-Clause License
- django-trusts-zero — continuation of the concrete django-trusts 0.x model
- django-trusts-zero-example — runnable application using Zero
- django-trusts-gh-permissions — organization, team, and repository relationship reference
- django-trusts-ordered-fold — provisional PostgreSQL ordered allow/deny extension
- django-trusts-windows-acl — Windows ACL example built on the OrderedFold extension
Copyright BeeDesk, Inc., 2015–2026. Released under the BSD 2-Clause License.