Python doesn't have enumerations, per se. Here's how I'd represent that:

    if 'edit' in structure['access']:
         # can edit
    

In which case it really doesn't matter if there's junk in access. If I really felt the need to validate the structure, I could do so with:

    if not set(structure['access']).issubset(all_access_privs):
        raise ValueError('invalid access types passed in')

but more realistically, I'd rely on the ORM object to validate against the authoritative source - the database - and key off the errors there.