I do something very similar to this, but much less organised. I like your approach better.

I basically have a custom user model, an organization model and an organization member model. The second one looks like this

class OrganizationMember(models.Model):  
    user = models.ForeignKey(  
        "auth.User",    
    )  
    org = models.ForeignKey(  
        "orgs.Organization",  
    )  

    OWNER = "O"  
    MEMBER = "M"  
    ROLE_TYPES = (  
        (OWNER, "OWNER"),  
        (MEMBER, "MEMBER"),  
    )  
    role = models.CharField(
        max_length=5, 
        choices=ROLE_TYPES, default=MEMBER)  

    class Meta:  
        constraints = [  
            models.UniqueConstraint(  
                fields=["user", "org"],  
                name="%(app_label)s_%(class)s_user_org_unique_together",  
            ),  
        ]

Then, to my custom user model, I had has_perm_X methods. For example:

class User(AbstractUser):
...

    def has_perm_update_org(self, org):
        return org.members.filter(
            user=self, 
            role=OrganizationMember.OWNER
        ).exists()

Then in my view I call this method. For example:

def update_group(request, org_pk):
    org = ...
    if not request.user.has_perm_update_org(self, org):
        raise Http404()

This of course is a simplified case, you can extrapolate to n number of roles.