def delete(self, request, *args, **kwargs):
        pk = kwargs.get('pk', None)
        if pk:
            instance = Comment.objects.get(pk=pk)
            if request.user.id != instance.created_by.id:
                return HttpResponseForbidden()
        return super(CommentViewSet, self).delete(request, *args, **kwargs)
Users can only delete comments that they themselves have created.
dataset/ETHPy150Open upconsulting/IsisCB/isiscb/isisdata/views.py/CommentViewSet.delete