Django Groups and Permissions

Groups are like team badges — instead of giving each person permissions one by one, you hand out badges that already carry a bundle of permissions.

In this page:

Creating a Group
Adding a User to a Group
Checking Combined Permissions

Creating a Group

A Group is created once and then reused — permissions attached to the group apply to every user in it.

Example: Creating a Group

Any user later added to the Editors group automatically gains the change_article permission.

bash

python manage.py shell

>>> from django.contrib.auth.models import Group, Permission
>>> editors = Group.objects.create(name='Editors')
>>> perm = Permission.objects.get(codename='change_article')
>>> editors.permissions.add(perm)

⚠️ Run this command in your terminal.

Adding a User to a Group

Once a group exists, assigning a user to it grants them every permission the group holds.

Example: Adding a User to a Group

alice now inherits every permission attached to the Editors group without any permission being set on her directly.

bash

python manage.py shell

>>> from django.contrib.auth.models import User, Group
>>> alice = User.objects.get(username='alice')
>>> editors = Group.objects.get(name='Editors')
>>> alice.groups.add(editors)

⚠️ Run this command in your terminal.

Checking Combined Permissions

has_perm() checks both permissions assigned directly to the user AND permissions inherited from their groups.

Example: Checking Combined Permissions

This returns True because Alice inherited change_article from the Editors group, even without a direct grant.

bash

python manage.py shell

>>> alice.has_perm('app.change_article')
True

⚠️ Run this command in your terminal.

Common Mistakes

Assigning permissions to every user individually instead of creating a Group once and adding users to it.
Forgetting that a model's default add/change/delete/view permissions are auto-created only after running migrations.
Confusing is_staff (can log into /admin/) with having actual model permissions — staff status alone doesn't grant permissions.

Chapter Summary

Groups bundle multiple permissions together so they can be assigned to many users at once.
Django auto-creates add/change/delete/view permissions for every model.
user.groups.add(group) assigns a user to a group; user.has_perm(...) checks their combined permissions.
Managing permissions through groups scales better than assigning them per-user.

🔒

Chapter Quiz — Complete all 12 topics to unlock

0/12 topics done

Complete these topics first:

← Previous Lesson The permission_required Decorator Next Lesson → Password Hashing in Django

Django Groups and Permissions

Creating a Group

Adding a User to a Group

Checking Combined Permissions

Chapter Quiz — Complete all 12 topics to unlock

Login to run this code