def has_object_permission(self, request, view, obj):
        """
        Allow staff or superusers, and the owner of the object itself.
        """
        user = request.user
        if not user.is_authenticated:
            return False
        elif user.is_staff or user.is_superuser:
            return True
        return user == obj.user
Allow staff or superusers, and the owner of the object itself.