When attempting to use @action to override permission_classes on a per-method basis (as the documentation suggests is possible), it appears that the additional keyword arguments are lost.

Test case:

class BookViewSet(mixins.RetrieveModelMixin, mixins.UpdateModelMixin,
                  viewsets.GenericViewSet):
    queryset = Book.objects.all()
    serializer_class = BookSerializer
    permission_classes = []

    @action(permission_classes=[AuthorBookset])
    def update(self, request, *args, **kwargs):
        return super(BookViewSet, self). update(request, *args, **kwargs)

This happens because APIView.get_permissions() uses self.permission_classes when creating permission instances. @action decorates a method on a subclass of APIView, and assigns those additional keyword arguments as a property of the decorated method. Since they are applied to the method and not used to update the class, APIView.get_permissions() never sees them and they are lost.