docs: def add_redact_annotation(request, query):
      """Flag LogEntry records that require ``ipAddress`` and ``subject`` fields to be
      redacted before being returned to the client.
  
      Only trusted subjects and subjects with ``write`` or ``changePermission`` on a
      SciObj receive unredacted ``ipAddress`` and ``subject`` in LogEntry records for the
      associated SciObj.
  
      Subjects with only ``read`` access receive redacted records.
  
      """
      return query.annotate(
          redact=django.db.models.Exists(
              d1_gmn.app.models.Permission.objects.filter(
                  sciobj=django.db.models.OuterRef('sciobj'),
                  subject__subject__in=request.all_subjects_set,
                  level__gte=d1_gmn.app.auth.WRITE_LEVEL,
              ),
              negated=True,
          )
      )