Two front doors: Module-level access in a Django GRC app

GitLab’s engineering team redesigned an internal Django GRC platform after expanding it from Security Compliance to Internal Audit, exposing that login-only checks authenticated users without determining whether they are authorized to access another team’s sensitive data. The redesign separates shared platform functions such as authentication, user management, audit logging, and UI components into a core project, while independent Security Compliance and Internal Audit modules own their respective models, views, and APIs without depending on one another. Access is enforced through Django’s built-in groups, with a reusable core GroupRequiredMixin and module-specific subclasses that deny unauthorized requests, while corresponding REST API permissions and navigation filters provide additional enforcement and appropriate user experience. The approach treats hidden navigation as a usability feature rather than a security measure, ensuring users cannot bypass restrictions through direct URLs. This modular structure is intended to make future workflows easier to add by reusing centralized authentication, authorization, and audit capabilities while keeping data and responsibilities clearly separated.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.