Creating a customized permission class for object-level permissions