Django's Permission System

Model permissions come for free. Every model gets add, change, delete and view permissions automatically. Users and groups can hold them, and you check with request.user.has_perm("posts.change_post").

Groups are the useful part: define Editors once, give it permissions, and adding someone to the team is adding them to the group rather than ticking twenty boxes.

Where each tool fits.

Role-based questions, such as whether someone is an editor at all, fit the permission system.

Ownership questions, such as whether this is your post, do not: they depend on the specific object, and the cleanest answer is filtering the query by the owner.

Most applications need both, and confusing them is why permission code becomes tangled.