Do not override permissions if already provided

This allows beforeAnnotationCreated hooks to provide their own permissions objects.