This feels like the wrong way to do this to me. I think you're trying to do stats permissions based on if the user owns the app? Whereas this is more of a class level general ACL check.

After looking at `check_stats_permission`, it seems like you could create a `StatsPermissionAuthorization` class that does something similar for the API and avoid a specific check override for what is used generally everywhere else.