Django Permissions, User Groups & Role-Based Access Control (RBAC)

Authentication answers the question: "Who are you?" Authorization answers: "What are you allowed to do?" Django provides a mature, fine-grained Role-Based Access Control (RBAC) framework based on permissions and groups.

The Anatomy of a Permission String

Django identifies permissions using an <app_label>.<action>_<modelname> notation:

• blog.view_blogpost: Can view blog post records.
• blog.add_blogpost: Can publish new blog posts.
• blog.change_blogpost: Can edit existing articles.
• blog.delete_blogpost: Can permanently remove articles.

Declaring Custom Permissions on Models

Define domain-specific permissions inside your model's Meta class:

# blog/models.py
class BlogPost(models.Model):
    title = models.CharField(max_length=200)
    # ... fields ...

    class Meta:
        permissions = [
            ("can_publish_article", "Can toggle article publication state"),
            ("can_feature_article", "Can spotlight article on homepage"),
        ]

Enforcing Permissions in Views and Templates

# In Class-Based Views:
from django.contrib.auth.mixins import PermissionRequiredMixin
from django.views.generic import UpdateView

class ArticlePublishView(PermissionRequiredMixin, UpdateView):
    model = BlogPost
    permission_required = 'blog.can_publish_article'
    # Automatically returns 403 Forbidden or redirects to login if user lacks permission!

Inside templates, show buttons only to users who hold the permission:

<!-- templates/blog/post_detail.html -->
<h1>{{ post.title }}</h1>

{% if perms.blog.change_blogpost %}
    <a href="{% url 'blog:post_update' post.slug %}" class="btn btn-warning">Edit Article</a>
{% endif %}

{% if perms.blog.can_publish_article %}
    <button class="btn btn-success">Approve for Publication</button>
{% endif %}