Search for a command to run...
Series
Thinking in Django & DRF is a series about Django & DRF by understanding why things are designed the way they are. It explores insights from mastering Django & DRF, like syntax, shortcuts, abstraction, invariants, and architectural boundaries.
Authorization in Django often feels unclear at first because permissions, groups, roles, and access checks appear disconnected, and the boundary between framework responsibility and application responsibility is rarely made explicit. This post explai...
If authorization in Django feels confusing, a big reason is that permissions often get described as if they do work. They don’t. A Django permission is not a rule engine. It is not a policy. It is not an authorization decision. It is simply a named c...
Once we stop treating permissions as rules and start treating them as data, a natural question follows: Data about what? A permission is a label that says, *“*this action applies to that thing.” But how does Django identify that thing—especially in a...
Understanding How Django Establishes Permissions
Stable Identities for Deterministic Permission Resolution
Boundaries of Capability in Django Authorization
