Object-level access control checks that a user has the right to act on a specific instance, not just on a model type. For example, a user should only edit their own posts. You apply it by filtering queries on the owner or by returning 403/404 if the object does not belong to them, which prevents direct object reference attacks by identifier.
Example
post = get_object_or_404(Post, pk=pk, author=request.user)