def _permissions(annotation):
    """
    Return a permissions dict for the given annotation.

    Converts our simple internal annotation storage format into the legacy
    complex permissions dict format that is still used in some places.

    """
    read = annotation.userid
    if annotation.shared:
        read = 'group:{}'.format(annotation.groupid)

    return {'read': [read],
            'admin': [annotation.userid],
            'update': [annotation.userid],
            'delete': [annotation.userid]}