Pyramid has a very flexible security system http://docs.pylonsproject.org/projects/pyramid/en/latest/nar...

You can define access control policies on a resource by resource basis. These can, where necessary, allow or deny permissions to individuals or roles based on the resource and request data.

There's a nice demo / walk through of capabilities here https://github.com/mmerickel/pyramid_auth_demo