django-rules VS django-guardian

https://github.com/dfunckt/django-rules A generic, approachable open source framework for building rule-based systems in Django (Python).

imo the most feature rich and granular object level permissions can be implemented using django-rules. They work with django admin, drf, views, cbv and are pretty simple to set up and use.

Check out the django-rules package.

You can mitigate the pain by using libraries like accesscontrol, express-rbac, django-guardian, etc., to manage authorization more declaratively. But making sure nothing leaks is still a significant challenge.

These pieces fit together very well and are sufficient for replacing most of the goodies Django provides. However, there's one piece missing. Django has a built-in permissions feature, but it's limited to model-level control, i.e., if a user or group has X access to model type Y. Many users have been using the popular django-guardian package to implement row-level permissions. It allows you to establish permissions between users/groups and objects, manages the underlying permission database tables, and provides APIs for configuring and checking such permissions.

https://github.com/django-guardian/django-guardian/issues?q=is%3Aopen+is%3Aissue+label%3ABug

Could use django-guardian for this instead: https://github.com/django-guardian/django-guardian

I was about to use django-guardian until I came across the following in the official documentation:

django-guardian for per object permissions