The `djangorestframework-composed-permissions` package for DRF gets pretty close to handling this situation effectively. Basically roles and permissions arbitra

The `djangorestframework-composed-permissions` package for DRF gets pretty close to handling this situation effectively. Basically roles and permissions arbitrarily composable with boolean expressions. Although you can model permission hierarchies, I think there are enough corner cases that it's worthwhile to declare permissions as explicitly as conveniently possible. API Docs: https://djangorestframework-composed-permissions.readthedocs.org/en/latest/ https://djangorestframework-composed-permissions.readthedocs...