ManyToManyField - how to constrain

Best way to create a many-to-one relationship between django.contrib.auth.models.User and my own Company model (i.e. many users in one company)? Unless I was inclined to add a ManyToOneField to the User model (which I'm not), then is a ManyToManyField in my Company model the best way of dealing wi

Object permissions with user authentication

Is there a recommended way of implementing object permissions with Django's User authentication systems (i.e. a way of enforcing access/ authorisation restrictions on an object-basis)? The Django documentation states that there is "a foundation for object permissions, though there is no implementa