Admin Permissions
In this page:
The Four Default Permissions
For every model Django registers, it automatically creates add, change, delete, and view permissions. A staff user needs the relevant one to perform that action in the admin.
Example: The Four Default Permissions
Lists the four auto-created permissions for a Book model.
python manage.py shell
>>> from django.contrib.auth.models import Permission
>>> Permission.objects.filter(content_type__model='book')
<QuerySet [<Permission: core | book | Can add book>, <Permission: core | book | Can change book>, ...]>⚠️ Run this command in your terminal.
Assigning Permissions Directly to a User
A staff user (is_staff=True) with no permissions sees an empty admin. Permissions must be granted explicitly, either individually or through a group.
Example: Assigning Permissions Directly to a User
Grants the editor user permission to change Book records in the admin.
python manage.py shell
>>> from django.contrib.auth.models import User, Permission
>>> user = User.objects.get(username='editor')
>>> perm = Permission.objects.get(codename='change_book')
>>> user.user_permissions.add(perm)⚠️ Run this command in your terminal.
Using Groups for Bulk Permissions
Instead of assigning permissions one user at a time, create a Group with the right permissions and add users to it -- much easier to manage as your team grows.
Warning: is_superuser overrides all of this: a superuser can do everything regardless of assigned permissions or group membership.
Example: Using Groups for Bulk Permissions
Creates an Editors group with the change_book permission and adds the user to it.
python manage.py shell
>>> from django.contrib.auth.models import Group
>>> editors = Group.objects.create(name='Editors')
>>> editors.permissions.add(perm)
>>> user.groups.add(editors)⚠️ Run this command in your terminal.
- Giving a user is_staff=True without any specific permissions, then being confused why they see an empty admin with nothing to manage.
- Confusing is_staff (can log in to /admin/) with is_superuser (bypasses all permission checks).
- Forgetting that permissions can be granted individually or in bulk through Groups, not just per-user.
- Every model gets four automatic permissions: add, change, delete, and view.
- is_staff allows admin login; individual permissions decide what a staff user can actually do there.
- Groups bundle permissions together so they can be assigned to many users at once.
- is_superuser bypasses all permission checks entirely.
Chapter Quiz — Complete all 8 topics to unlock
0/8 topics done
Complete these topics first: