There is an interesting security issue with this permission that I encountered while converting the Ratings API.

You need **all** classes to implement their own `has_permission` and `has_object_permission` method, because the default implementation is to return `True` in both cases.

This is usually not a problem to have a class implementing only `has_permission`, because having it return `False` is enough to prevent all access, but when using `AnyOf`, since all classes are considered, another class could give `has_permission` and your `has_object_permission`, being not implemented, would return `True`

Example scenario:
`AnyOf(AllowAppOwner, GroupPermission('Users', 'Edit'))`

`AllowAppOwner.has_permission()` only requires the user to be authenticated, the real check is done in its `has_object_permission`. `GroupPermission` doesn't have an `has_object_permission` implementation however, so it uses the default one, and returns `True`... meaning any authenticated user in this scenario could proceed without the special group permission.

Beside introspection I'm not sure how we can guarantee that the caller knew about this and checked the implementation of the permissions he's using. What can we do ?