Authorization / permissions is handed via the Django admin, django-guardian and some customizations.