def add_redact_annotation(request, query):
    """Flag LogEntry records that require ``ipAddress`` and ``subject`` fields to be
    redacted before being returned to the client.

    Only trusted subjects and subjects with ``write`` or ``changePermission`` on a
    SciObj receive unredacted ``ipAddress`` and ``subject`` in LogEntry records for the
    associated SciObj.

    Subjects with only ``read`` access receive redacted records.

    """
    return query.annotate(
        redact=django.db.models.Exists(
            d1_gmn.app.models.Permission.objects.filter(
                sciobj=django.db.models.OuterRef('sciobj'),
                subject__subject__in=request.all_subjects_set,
                level__gte=d1_gmn.app.auth.WRITE_LEVEL,
            ),
            negated=True,
        )
    )