title: Role-based authorization mechanism for a GAE app
body: <p>I'm looking for a role-based framework/module/package for an app written in Python (2.7) running on Google App Engine.</p>
  
  <p>With role-based I mean a mechanism that would allow me to check (during a request processing most of the time) whether a certain user is able to perform a specific action.</p>
  
  <p>A couple use cases: </p>
  
  <ul>
  <li>user A should be able to see and modify own profile, whereas user B should only be able to see user A profile. </li>
  <li>user with an "admin" role should be able to see all registered users, whereas user A and user B should only be able to see users with a public profile (e.g. users with user.public property set to True)</li>
  <li>etc.</li>
  </ul>
  
  <p>I'm imagining something like </p>
  
  <pre><code>user_a.is_able_to('read', user_b) # -&gt; True of False
  </code></pre>
  
  <p>or</p>
  
  <pre><code>user_a.authorize('update', user_b) # raises an exception if 'not allowed to'
  </code></pre>
  
  <p>So far I've only seen <a href="http://code.google.com/p/tipfy/source/browse/tipfy/appengine/acl.py" rel="noreferrer">acl.py</a> from tipfy. Looks quite simple and pretty much close to what I'm looking for. I'm wondering whether there's something similar to that acl.py, preferably implemented using NDB.</p>