title: Dynamic user based authorization in Pyramid
body: <p>I'm following <a href="http://docs.pylonsproject.org/projects/pyramid/1.1/narr/security.html" rel="nofollow noreferrer">security guidelines found on Pyramid docs</a> along with wiki tutorial <a href="http://docs.pylonsproject.org/projects/pyramid/1.0/tutorials/wiki2/authorization.html" rel="nofollow noreferrer">Adding Authorization</a> </p>
  
  <p>Now I need to add restrictions based un single user rather than groups.</p>
  
  <p>Let's say for example that, if any blog editor can have permission to review all comments, <strong>only post author can edit the post itself</strong>.</p>
  
  <p>For the first task I will have in my Root ACL like this:</p>
  
  <pre><code>__acl__ = [ (Allow, Everyone, 'view'),
              (Allow, Authenticated, 'view_profile'),
              (Allow, 'groups:editor', 'edit_comment')
  ]
  </code></pre>
  
  <p>but whay about for <code>edit_post</code>?</p>
  
  <p>I've read <a href="https://stackoverflow.com/questions/5761617/pyramid-authorization-for-stored-items">this answer</a> but seems overkill to me for my needs since I don't need to build a resource tree.</p>