django-guardian
Delegate django rest framework object permissions to an object pointed by foreign key/m2m