sample.py

#!/usr/bin/env python

directory = [
        {'department': 123, 'location': 'NYC', 'username': 'bob', 'roles':
            ['developer', 'sysadmin']},
        {'department': 123, 'location': 'SYD', 'username': 'fred', 'roles':
            'developer'},
        {'department': 234, 'location': 'NYC', 'username': 'harry', 'roles':
            'sysadmin'},
        ]

rules = {'123_NYC': {'criteria': {'department': 123, 'location': 'NYC'}},
        '123_SYD': {'criteria': {'department': 123, 'location': 'SYD'}},
        '123_NYC|SYD': {'criteria': {'department': 123, 'location': ['SYD', 'NYC']}},
        'NYC_SYSADMIN': {'criteria': {'location': 'NYC', 'roles': 'sysadmin'}},
        'ALL_STAFF': {},
        'NOT_NYC': {'negative': {'location': 'NYC'}}}


def setted(input):
    if not hasattr(input, '__iter__') or isinstance(input, basestring):
        return set([input])
    else:
        return set(input)

def test_criteria(criteria, user):
    meets_rule = True
    for criteria, c_value in criteria.iteritems():
        c_value = setted(c_value)
        meets_criteria = False
        if criteria in user:
            meets_criteria = c_value <= setted(user[criteria])
        meets_rule = meets_rule and meets_criteria
    return meets_rule

def test_negative(criteria, user):
    meets_rule = True
    for criteria, c_value in criteria.iteritems():
        c_value = setted(c_value)
        meets_criteria = False
        if criteria in user:
            meets_criteria = c_value >= setted(user[criteria])
        meets_rule = meets_rule and meets_criteria
    return meets_rule

def matcher(rule, user):
    meets_rule = True
    if 'criteria' in rule:
        meets_rule = meets_rule and test_criteria(rule['criteria'], user)
    elif 'negative' in rule:
        meets_rule = meets_rule and test_negative(rule['negative'], user)
    return meets_rule

for user in directory:
    user_rules = []
    for rule in rules:
        if matcher(rules[rule], user):
            user_rules.append(rule)
    print "User: %s\n  Rules: %s" % (user['username'], user_rules)