Use annotation_consent to pull record consents

Add Record.permission for checking.  This may be enough to start making views
now?