The `djangorestframework-composed-permissions` package for DRF gets pretty close to handling this situation effectively. Basically roles and permissions arbitrarily composable with boolean expressions.

Although you can model permission hierarchies, I think there are enough corner cases that it's worthwhile to declare permissions as explicitly as conveniently possible.

API Docs: https://djangorestframework-composed-permissions.readthedocs...