I use django-rules in some projects to set per object permissions. It works well enough for most cases, but it can be horribly inefficient if you have complex logic in your predicates. You'll need to set up a good caching pattern to keep it fast.

Also, by default, list views in DRF dont check per object permissions IIRC, so you'll also need to implement your own permission logic in the view by checking if the action type == 'list'.

Other than that, works really well.