Django's built-in access control system is very good for basic operations and Guardian is a natural extension to the object level. However, our customers wanted more: a group hierarchy, just-in-time privileged access, delegating permissions to other users, custom permissions. This talk tells the story of how an authentication company built a role-based authorization system for Django.