# Object permissions with django-rules

EUSRR combines Django model permissions, DRF permission classes and
`django-rules` object predicates. Authentication alone never implies access to a
domain object.

Rule modules currently exist in employees, communications, documents, feed,
requests, procurement and scheduling. Each domain owns its predicates; do not
create a central list that duplicates their implementation.

## Usage

```python
if request.user.has_perm("communications.change_chat", chat):
    ...
```

DRF viewsets must also restrict list querysets. An object permission applied only
after `get_object()` does not protect list/search endpoints.

When adding a rule:

1. implement small predicates in the domain's `rules.py`;
2. register a namespaced rule or permission;
3. use it from the API permission layer and service boundary;
4. cover owner, allowed member, unrelated user and superuser behavior;
5. test list visibility separately from detail mutation.

Frontend flags may hide unavailable actions but are not an authorization
boundary. See [`backend/docs/guides/CHAT_ROLES.md`](../../backend/docs/guides/CHAT_ROLES.md)
for the communications role mapping.