This can be done with normal path-based ACLs, but you need to allow more than just access to cq:annotations.EDIT: I forgot to mention, the permissions below are on the /content node as allow with jcr:read & rep:write base permissions, and restrictions based on the lists below.You need to allow write...