Install & Compatibility
Where this runs
tested against v5.1.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 1.039s · 43.7MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 4.6s · import 0.993s · 45MB
48MB installed
● package 48MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Enforcer
✓ from oslo_policy import Enforcer
✗ from oslo_policy import Enforcer
This quickstart demonstrates how to define policy rules, initialize an `Enforcer`, and use its `authorize` method to check permissions based on user context and target data. It shows successful and failed authorization attempts for different user roles and resource ownership scenarios.
from oslo_policy import policy
# Define policy rules inline for simplicity.
# In a real application, these would typically be loaded from a policy file
# (e.g., policy.yaml or policy.json) configured via oslo.config.
# Example: enforcer = policy.Enforcer(policy_file='path/to/policy.yaml')
rules = {
"admin_api": "role:admin",
"member_api": "role:member",
"owner_api": "project_id:%(project_id)s"
}
# Initialize the Policy Enforcer
enforcer = policy.Enforcer(rules=rules)
# Context for an admin user
admin_context = {
"user_id": "admin_user",
"roles": ["admin"],
"project_id": "admin_project"
}
# Context for a regular member user
member_context = {
"user_id": "member_user",
"roles": ["member"],
"project_id": "member_project"
}
# Target data for owner check (e.g., a resource's project_id)
target_data_owner = {"project_id": "member_project"}
target_data_other = {"project_id": "another_project"}
print("--- Admin User Checks ---")
try:
enforcer.authorize("admin_api", admin_context)
print("Admin can access admin_api: YES")
except policy.PolicyNotAuthorized as e:
print(f"Admin can access admin_api: NO ({e})")
try:
enforcer.authorize("member_api", admin_context)
print("Admin can access member_api: YES")
except policy.PolicyNotAuthorized as e:
print(f"Admin can access member_api: NO ({e})")
print("\n--- Member User Checks ---")
try:
enforcer.authorize("admin_api", member_context)
print("Member can access admin_api: YES")
except policy.PolicyNotAuthorized as e:
print(f"Member can access admin_api: NO ({e})") # Expected: NO
try:
enforcer.authorize("member_api", member_context)
print("Member can access member_api: YES")
except policy.PolicyNotAuthorized as e:
print(f"Member can access member_api: NO ({e})")
# Check owner_api (member accessing their own project)
try:
enforcer.authorize("owner_api", member_context, target_data_owner)
print("Member can access owner_api for their project: YES")
except policy.PolicyNotAuthorized as e:
print(f"Member can access owner_api for their project: NO ({e})")
# Check owner_api (member accessing another project)
try:
enforcer.authorize("owner_api", member_context, target_data_other)
print("Member can access owner_api for another project: YES")
except policy.PolicyNotAuthorized as e:
print(f"Member can access owner_api for another project: NO ({e})") # Expected: NO
openstack --version
Upgrade
Version history
5.1.0latest on PyPI · released May 18, 2026
Audit
Dependencies
oslo.configoptionalCommonly used for configuration management and policy file loading in OpenStack applications.