code: def has_object_permission(self, request, view, obj):
          
          user = request.user
          if not user.is_authenticated:
              return False
          elif user.is_staff or user.is_superuser:
              return True
          return user == obj.user
docs: Allow staff or superusers, and the owner of the object itself.