def METHOD_NAME(self, request, view, obj):
    if (
        request.user
        and request.user.is_authenticated
        and request.user == obj.owner
    ):
        return True
    if not obj.public:
        # if the bundle isn't public, we don't want to leak the fact that
        # it exists
        raise exceptions.NotFound
    return request.method in permissions.SAFE_METHODS