<SYSTEM_TASK:>
Solve the following problem using Python, implementing the functions described below, one line at a time
<END_TASK>
<USER_TASK:>
Description:
 def add_redact_annotation(request, query):
 """Flag LogEntry records that require ``ipAddress`` and ``subject`` fields to be redacted before being returned to the client. Only trusted subjects and subjects with ``write`` or ``changePermission`` on a SciObj receive unredacted ``ipAddress`` and ``subject`` in LogEntry records for the associated SciObj. Subjects with only ``read`` access receive redacted records. """

    return query.annotate(
        redact=django.db.models.Exists(
            d1_gmn.app.models.Permission.objects.filter(
                sciobj=django.db.models.OuterRef('sciobj'),
                subject__subject__in=request.all_subjects_set,
                level__gte=d1_gmn.app.auth.WRITE_LEVEL,
            ),
            negated=True,
        )
    )