The tutorial

A shop, built a layer at a time: customers place orders at one of two branches, each branch has a manager, and an accountant reads every order with its price. Every piece of code on these pages is read straight from the example project, whose tests run with the library's own - so what you read here is what runs.

What the shop needs

who	may
a branch manager	read, edit and approve their branch's orders - never the price
the accountant	read every order, with its price, and change nothing
a customer	read their own orders, and place new ones - never priced, never approved
nobody	edit an order once it is delivered

The steps

	step	what it adds
1	Running the shop	the example, its people and its orders
2	Permissions	what can be done to an order
3	Bundles	permissions given together, in the admin site
4	Row scopes in code	"their own orders", "their branch's orders"
5	Rule scopes in the admin site	a scope built with no code
6	Protected fields	the price, read by whoever may
7	Status actions	only whoever may approve sets approved
8	Policies	the rule no permission can say
9	Views and the API	Django's views and DRF, asking the same rules
10	Roles	what a customer can never hold
11	Access as code	the bundles and roles, reviewed like code
12	Names in every language	a bundle named in Persian

Each step stands on the one before it, but each layer works without the next: a project can stop after step 4 and be complete.