I suspect there's a better way to do this. Instead of putting the value in a temporary cache, it could be wrapped in a descriptor which does the magic when it becomes affiliated with a class.

The descriptor approach—if it is at all feasible—won't work with the set_roles syntax, as that explicitly marks up the object passed to it rather than wrapping it.

title = db.Column(db.Unicode(250))
set_roles(title, read={'all'})

Will need to change to:

title = db.Column(db.Unicode(250))
title = with_roles(title, read={'all'})

While this is currently valid syntax (it looks odd here but makes sense for properties), it means the set_roles syntax needs explicit deprecation.

The descriptor trick was a guess based on the __set_name__ call, but it only works since Python 3.6. Not usable in Coaster which maintains 2.7 compatibility.