Agreed.  Let me add a bit of explanation.  So the thing about the permissions is that Django has the usual `has_change...`, `has_create...` and `has_delete...`.  So I used those.  I was puzzled at first, "why don't they have has_read".  But the I realized that it works quite differently.  With change, create and delete, you are either adding, changing or deleting a single object and you know what that object is (you already have it, or at least the data to make it) before you write to the database.  But with `has_read...`, you don't want to fetch everything from the database and then pick through the actual objects.  That would totally destroy query performance.  So I handle `has_read...` by allowing the user to push a query filter into `get_objects` that expresses what the user has permission to read.  So it ends up being there directly in the query language.  So that is what `qfilter` is about.  And that is why you are **correct** that it is not needed in put.  HTH.