Django: logic not well applied in template using permissions (perm - django

Question

I develop a Django app
I have specifics permission on 2 differents models
I use these permissions to display or not some link in a navbar
but I have an unexpected behavior I do not understand
below the html code with Django logic
code between should not be display with one of my user that do not have the two permissions
I control to be sure permissions are effectively False but even without permissions, links 'Randomize a patient' and 'Reallocate a patient' are displayed
what is wrong in my logic?
I give at the end, the entire navbar html code
partial template :
{% if user.is_authenticated %}
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle" href="#" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">{% trans 'Randomization' %}</a>
<div id="randomize" class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdown">
{% if user_allowed_to_randomize and user_can_randomize or allowed_to_randomize and can_randomize %}
**<!-- SHOULD NOT BE DISPLAY - START-->**
{% if perms.randomization.can_randomize %}
<a class="dropdown-item" href="{% url 'randomization:randomisation_edit' %}">{% trans 'Randomize a patient' %}</a>
{% endif %}
{% if perms.randomization.can_reallocate %}
<div class="dropdown-divider"></div>
<a class="dropdown-item" href="{% url 'randomization:reallocate_edit' %}">{% trans 'Reallocate a treatment' %}</a>
{% endif %}
**<!-- SHOULD NOT BE DISPLAY - END-->**
{% endif %}
</div>
</li>
<li class="nav-item">
<a class="nav-link" href="#">{% trans 'Pharmacy' %}</a>
</li>
{% endif %}
complete template :
{% load static %}
{% load i18n %}
<nav class="navbar navbar-expand-lg navbar-dark bg-dark mb-4">
<div class="container">
<a class="navbar-brand" href="">Intense TBM</a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
<span class="navbar-toggler-icon"></span>
</button>
<div class="collapse navbar-collapse" id="navbarSupportedContent">
<ul class="navbar-nav mr-auto">
<li>
</li>
<li class="nav-item active">
<a class="nav-link" href="{% url 'home' %}">{% trans 'Home' %}<span class="sr-only">(current)</span></a>
</li>
{% if user.is_authenticated %}
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle" href="#" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">{% trans 'Randomization' %}</a>
<!--Vérification stock via requete ajax stock avant d'afficher les menus deroulants-->
<div id="randomize" class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdown">
<!--affichage par défaut pour les profils utilisateurs 'Site'-->
<!--OU SI DROIT ATTRIBUE APRES SELECTION LISTE SITE-->
{% if user_allowed_to_randomize and user_can_randomize or allowed_to_randomize and can_randomize %}
{% if perms.randomization.can_randomize %}
<a class="dropdown-item" href="{% url 'randomization:randomisation_edit' %}">{% trans 'Randomize a patient' %}</a>
{% endif %}
{% if perms.randomization.can_reallocate %}
<div class="dropdown-divider"></div>
<a class="dropdown-item" href="{% url 'randomization:reallocate_edit' %}">{% trans 'Reallocate a treatment' %}</a>
{% endif %}
{% endif %}
</div>
</li>
<li class="nav-item">
<a class="nav-link" href="#">{% trans 'Pharmacy' %}</a>
</li>
{% endif %}
<li class="nav-item">
<a class="nav-link" href="#">{% trans 'Contact' %}</a>
</li>
</ul>
{% if user.is_authenticated %}
<ul class="navbar-nav">
<!--Vérification stock via requete ajax stock avant d'afficher le message d'alerte-->
<li class="nav-item" id="alerte">
<!--affichage par défaut pour les profils utilisateurs 'Site'-->
{% if user_allowed_to_randomize and not user_can_randomize or allowed_to_randomize and not can_randomize %}
<a class="nav-link" id="informations" href="#" style="color:red; padding-right: 50px;"><strong>{% trans 'Insufficient stock' %}</strong></a>
{% endif %}
</li>
<li class="nav-item dropdown">
<a class="nav-link dropdown-toggle" href="#" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
{{ user.username }}
</a>
<div class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdown">
<!--Sélection d'un site-->
<form id="site_selectionne" method="POST" class="post-form">
{% csrf_token %}
<div class="form-group">
<!--data-randomization-url utilisé pour passer l'url dans le fichier .js qui ne considère pas les tag dajgo-->
<!--data-randomization-url récupéré pour définir l'url de la requete ajax-->
<select name="site" class="form-control" id="site" data-randomization-url="{% url 'randomization:stock' %}">
<option></option>
{% for site in sites %}
<!--récupération du site sélectionné middleware/context_processor-->
{% if site.sit_abr == site_selectionne %}
<option value="{{ site.sit_ide }}" selected>{{ site.sit_nom }} - {{ site.reg.pay.pay_nom }}</option>
{% else %}
<option value='{{ site.sit_ide }}'>{{ site.sit_nom }} - {{ site.reg.pay.pay_nom }}</option>
{% endif %}
{% endfor %}
</select>
</div>
</form>
<!---->
<a class="dropdown-item" href="{% url 'password_change' %}">{% trans 'Change password' %}</a>
<div class="dropdown-divider"></div>
<a class="dropdown-item" href="{%url 'logout'%}">{% trans 'Logout' %}</a>
</div>
</li>
</ul>
{% else %}
<form class="form-inline my-2 my-lg-0">
{% trans 'Login' %}
</form>
{% endif %}
</div>
</div>
</nav>