policy-pattern

A small, embeddable ReBAC authorization engine for Python, inspired by Google Zanzibar.

policy-pattern is a standalone Python library for relationship-based access control (ReBAC). It models authorization as relationships between subjects and objects and evaluates those relationships through composable authorization rules.

• No authorization server
• No required framework
• No required database
• No network hop

The library is designed to be embedded directly into Python applications that need richer authorization semantics than traditional role-based access control.

Status: v1 is code-complete — model, compile(), the storage port, MemoryTupleStore, and the Evaluator all exist and are tested.

See Architecture § Scope for what's planned (v1.x/v2) and unscheduled ideas.

Table of Contents

• Example
• Documentation
• Contributing
• License
• References

Example

model = Model()
model.types["document"] = Type(
    name="document",
    relations={
        "owner": Relation(allowed_subject_types=("user",)),
        "parent": Relation(allowed_subject_types=("folder",)),
    },
    permissions={
        "viewer": Union(left=Reference(name="owner"), right=TupleToUserset(tupleset="parent", computed="viewer")),
    },
)
compiled = model.compile()

evaluator = Evaluator(model=compiled, store=store)
evaluator.check(alice, "viewer", document_42)

viewer here means "the document's own owner, or the owner of whatever folder it lives in" — a document under folder:engineering inherits access from that folder without copying a permission onto every document.

See the Usage Guide for the full, runnable walkthrough — every rewrite operator, nested groups, EvaluationBudget, and error handling.

Documentation

The repository uses specifications and architecture documents as part of the implementation contract — they describe what must be true, independent of any one adapter's implementation.

docs/
├── README.md        — documentation index, start here
├── usage/README.md  — worked examples for every rewrite operator, budgets, error handling
├── architecture.md  — the model shape, compile(), the storage port, the evaluator, and scope/roadmap
├── semantics.md     — the storage contract every TupleStore adapter must satisfy
└── errors.md        — the PPxxx error code ranges and what each one means

Start with the Usage Guide to see the library working end to end, then Architecture to understand why the model is shaped the way it is.

Contributing

We love community help! Before you open an issue or pull request, please read:

• How to Contribute
• Code of Conduct
• Security Policy

License

Licensed under the Apache License 2.0.

References

The design is influenced by authorization systems and literature including:

• Google Zanzibar
• OpenFGA
• SpiceDB / AuthZed

policy-pattern is an independent project and is not an implementation of, or affiliated with, those projects.