Does Django provide object-level permissions by default, and how should you enforce them?

I centralize policy inputs—actor, capability, tenant, object state, and requested action—rather than spreading if request.user == obj.owner across views. Query scoping and policy checks provide defense in depth but must agree, including administrative bypasses. Tests use two users and two tenants, guessed ids, nested resources, bulk identifiers, cached responses, and indirect relations. Denied decisions carry safe audit context without revealing that a private object exists.