Spiff Guard is a library implementing generic access lists for Python. It was designed to provide a clean API, high security and high scalability.

Spiff Guard's features include recursion, groups, Python type awareness, inverse lookup, and a lot more. For a more complete example, have a look into the README file included with the package.

Working with an ACL is as simple as this:

from Guard import *
guard   = DB(db_connection)
group   = ResourceGroup("My Group")
user    = Resource("My User")
website = ResourceGroup("My Website")
view    = Action("View")
write   = Action("Edit")
guard.add_action([view, write])
guard.add_resource([user, group, website])
guard.grant(group, view, website)
guard.grant(user,  edit, website)
if guard.has_permission(user, view, website):
    print 'Permission granted.'