Use composable permission class
If appropriate: https://www.django-rest-framework.org/community/3.9-announcement/#composable-permission-classes Requires to update Django Rest Framework
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information