Yes, mostly it should be sufficient to add required permissions to relevant api implementation, so that test can find it in test_data._meta.api_class.permissions (and change_for_update method for update test), will try to add arcitectures to demonstrate :)