Staff-Only and Owner-Only Access Rules in Django REST Framework

… more less Some endpoints should answer only staff users, and others only the user who owns a row. A permission class or a filtered queryset enforces this, and an outsider gets 403 or 404.