Composed permissions like IsAuthenticated() & (IsOwner() | IsAdminUser()) raised TypeError because _AND/_OR/_NOT used isinstance(x, BasePermission) to decide whether to call x() — but composed objects aren't BasePermission subclasses. Added _resolve_perm() helper that recognizes all permission types (_AND, _OR, _NOT, BasePermission) and passes them through as-is.