Admin Permissions
In this page:
# Default permissions per model: add, change, delete, view
user.has_perm('app_name.add_modelname')
from django.contrib.auth.models import Permission
user.user_permissions.add(Permission.objects.get(codename='change_modelname'))The Four Default Permissions
For every model Django registers, it automatically creates add, change, delete, and view permissions. A staff user needs the relevant one to perform that action in the admin.
Example: The Four Default Permissions
Lists the four auto-created permissions for a Book model.
python manage.py shell
>>> from django.contrib.auth.models import Permission
>>> Permission.objects.filter(content_type__model='book')
<QuerySet [<Permission: core | book | Can add book>, <Permission: core | book | Can change book>, ...]>⚠️ Run this in your own terminal or Node.js environment.
Assigning Permissions Directly to a User
A staff user (is_staff=True) with no permissions sees an empty admin. Permissions must be granted explicitly, either individually or through a group.
Example: Assigning Permissions Directly to a User
Grants the editor user permission to change Book records in the admin.
python manage.py shell
>>> from django.contrib.auth.models import User, Permission
>>> user = User.objects.get(username='editor')
>>> perm = Permission.objects.get(codename='change_book')
>>> user.user_permissions.add(perm)⚠️ Run this in your own terminal or Node.js environment.
Using Groups for Bulk Permissions
Instead of assigning permissions one user at a time, create a Group with the right permissions and add users to it -- much easier to manage as your team grows.
Example: Using Groups for Bulk Permissions
Creates an Editors group with the change_book permission and adds the user to it.
python manage.py shell
>>> from django.contrib.auth.models import Group
>>> editors = Group.objects.create(name='Editors')
>>> editors.permissions.add(perm)
>>> user.groups.add(editors)⚠️ Run this in your own terminal or Node.js environment.
- Giving a user is_staff=True without any specific permissions, then being confused why they see an empty admin with nothing to manage.
- Confusing is_staff (can log in to /admin/) with is_superuser (bypasses all permission checks).
- Forgetting that permissions can be granted individually or in bulk through Groups, not just per-user.
- Every model gets four automatic permissions: add, change, delete, and view.
- is_staff allows admin login; individual permissions decide what a staff user can actually do there.
- Groups bundle permissions together so they can be assigned to many users at once.
- is_superuser bypasses all permission checks entirely.
Chapter Quiz — Complete all 8 topics to unlock
0/8 topics done
Complete these topics first: