django permissions examples in admin

Example 1: how to create staff account in django

user = User.objects.create_user('john', '[email protected]', 'johnpassword')  
user.is_staff=True 
user.save()

Example 2: staff user is not restricting permission in django

class UserAdmin(BaseUserAdmin):
    ...
    def has_add_permission(self, request, obj=None):
        return request.user.is_superuser

    def has_delete_permission(self, request, obj=None):
        return request.user.is_superuser