there is `AllowAppOwner`, which does a query on the `obj.authors` queryset.