Airflow Summit 2026 is coming August 31 - September 2 in Austin, TX. Register now to secure your spot!

Deprecation Notice for airflow.security.permissions

Since the release of Airflow 3, the Flask AppBuilder (AKA “FAB”) provider is no longer a core Airflow dependency. However, some modules specifically designed for Flask AppBuilder (FAB) auth manager remain in the core Airflow distribution as a backwards-compatible convenience for Airflow users. One such module which remains in the core distribution for backwards compatibility purposes is airflow.security.permissions

If your deployment depends on airflow.security.permissions for any custom role definitions, or for any custom Auth Manager logic – regardless of whether you use the FAB Auth Manager or some other Auth Manager – you should transition to the new authorization standard definitions for resources and actions. The deprecated airflow.security.permissions will be removed in Airflow 4.

Does this Deprecation Affect My Airflow System?

Generally speaking, this deprecation warning applies to any Airflow system in which either of the following is true:

  • The Airflow deployment relies on airflow.security.permissions to define custom RBAC roles.

  • The Airflow deployment has other custom logic which relies on airflow.security.permissions, including any custom Auth manager dependencies.

However, if you rely on the unmodified Flask AppBuilder (FAB) auth manager and you do not use any custom role definitions, then the rest of this doc does not apply to you. Similarly, if you rely on the Simple auth manager or any of the other provider Auth Managers, and have no custom code using airflow.security.permissions, then the rest of this doc does not apply to you.

Note

Each customized Airflow RBAC setup differs on a case-by-case basis. As such, this doc can only provide general guidance for the transition to the new Airflow authorization standards, without being overly prescriptive.

How to Migrate to the New Authorization Standard Definitions

Refer to the list below for the deprecated permissions module components, and the corresponding supported replacement available from Airflow core:

  • airflow.security.permissions.ACTION_* –> airflow.api_fastapi.auth.managers.base_auth_manager.ResourceMethod

  • airflow.security.permissions.RESOURCE_* –> airflow.api_fastapi.auth.managers.models.resource_details

If you maintain a custom Auth manager which relies on the deprecated module, it is recommended you refer to the SimpleAuthManager’s source code as an example for how you might use the ResourceMethod and resource_details components.

If you rely on custom role definitions based off the deprecated module, you should refer to the documentation of the auth manager your system uses.

Migrating DAG.access_control

Unlike the components above, DAG.access_control has no drop-in replacement. It was an input to the FAB auth manager rather than an authorization mechanism of its own: at parse time its contents were expanded into that manager’s permission tables, and authorization then read those tables rather than the Dag argument.

Warning

Airflow only reads DAG.access_control when the configured auth manager is the Flask AppBuilder (FAB) auth manager. Under any other auth manager the argument is parsed and serialized but never consulted, so it neither grants nor denies access. A deployment that moves off the FAB auth manager and leaves access_control on its Dags stops enforcing those grants, and does so without raising an error.

To migrate, move the grants into the policy source your auth manager consults. The Auth manager guide covers how a custom auth manager should express Dag-level access.

Was this entry helpful?