title: How to define object-level permissions for foreign-key relationships
body: <p>I'm having trouble defining object-level permissions for foreign-key relationships in my <code>ModelViewSet</code>.  I'm not sure if it's entirely possible what I'm trying to do or if there's a better solution, but any hint in the right direction would be much appreciated.  I've shortened the models and serializers for the sake of brevity.</p>
  
  <p>I have the following models:</p>
  
  <pre><code>class Team(models.Model):
      name = models.CharField(max_length=50)
  
  class CustomUser(AbstractUser):
      teams = models.ManyToManyField(Team)
  
  class Client(models.Model):
      name = models.CharField(max_length=50)
      owner = models.ForeignKey(Team, on_delete=models.CASCADE)
  
  class FinancialAccount(models.Model):
      account_name = models.CharField(max_length=50)
      client = models.ForeignKey(Client, on_delete=models.CASCADE)
  </code></pre>
  
  <p>Then I have the following serializers:</p>
  
  <pre><code>class ClientSerializer(serializers.ModelSerializer):
      class Meta:
          model = Client
          fields = ('name', 'owner')
  
  class FinancialAccountSerializer(serializers.ModelSerializer):
      owner = serializers.SerializerMethodField()
  
      class Meta:
          model = FinancialAccount
          fields = ('name', 'client', 'owner')
  
      def get_owner(self, obj):
          return client.owner.name
  </code></pre>
  
  <p>Then I'm trying to define a permission that I can use in all of my ModelViewSets.  I'd like it to be somewhat dynamic as I have many more models than the ones above that are related to <code>Client</code> or even below <code>FinancialAccount</code>.  The permission and viewset are as follows:</p>
  
  <pre><code>class IsOwnerTeam(permissions.BasePermission):
      def has_object_permission(self, request, view, obj):
          teams = request.user.teams.values_list('name', flat=True)
          return obj.owner in teams
  
  class FinancialAccountViewSet(viewsets.ModelViewSet):
      serializer_class = FinancialAccountSerializer
      permission_classes = (IsOwnerTeam, )
  
      def get_queryset(self):
          teams = self.request.user.teams.all()
          clients = Client.objects.filter(owner__in=teams)
          return FinancialAccount.objects.filter(account__in=accounts)
  </code></pre>
  
  <p>So, right now I'm receiving this error:  <code>'FinancialAccount' object has no attribute 'owner'</code>, which makes sense because I don't have an owner field on the <code>FinancialAccount</code> object.  But, I thought if I had an owner field in the serializer (and put an owner field in each of the serializers) I could retrieve it that way.  Any help would be appreciated!</p>