DEFAULT_PERMISSION_CLASSES and per-view permission_classes override boundary
Goal is to define a permission configuration for Django REST Framework where no view is unintentionally publicly accessible. DRF’s documented default permission class is AllowAny, and a project-wide DEFAULT_PERMISSION_CLASSES setting in REST_FRAMEWORK can provide a baseline. Per-view permission_classes can override the global default, and the interaction bet