Implement object-level permissions.

[jathanism]

This isn't yet a requirement, but it will be. And when it becomes one, django-guardian is likely going to be what we'll use:

http://django-guardian.readthedocs.org/

[jathanism]

Also check out this inheritable permissions pattern which will be good inspiration for how we might handle them: http://vitan.github.io/linux/django/practical/python/2014/07/28/Inheritable-Object-Level-Permission-of-Django.html