Do not override permissions if already provided

This allows beforeAnnotationCreated hooks to provide their own
permissions objects.