Index: src/main/java/de/mpiwg/itgroup/annotations/Annotation.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/Annotation.java	(revision 95)
+++ src/main/java/de/mpiwg/itgroup/annotations/Annotation.java	(revision 105)
@@ -132,4 +132,11 @@
     
     /**
+     * Enum of actions (for permissions).
+     */
+    public static enum Action {
+    	read, update, create, delete, admin
+    }
+    
+    /**
      * Returns if the requested action is allowed for the given user on this annotation.
      * 
@@ -139,6 +146,6 @@
      * @return
      */
-    public boolean isActionAllowed(String action, Person user, AnnotationStore store) {
-        if (action.equals("read")) {
+    public boolean isActionAllowed(Action action, Person user, AnnotationStore store) {
+        if (action == Action.read) {
             Actor reader = getReadPermission();
             if (reader == null) {
@@ -148,5 +155,5 @@
                 return reader.isEquivalentWith(user, store);
             }
-        } else if (action.equals("update")) {
+        } else if (action == Action.update) {
             // require at least an authenticated user
             if (user == null) return false;
@@ -158,5 +165,5 @@
                 return updater.isEquivalentWith(user, store);
             }
-        } else if (action.equals("delete")) {
+        } else if (action == Action.delete) {
             // require at least an authenticated user
             if (user == null) return false;
@@ -167,5 +174,5 @@
             }
             return deleter.isEquivalentWith(user, store);
-        } else if (action.equals("admin")) {
+        } else if (action == Action.admin) {
             // require at least an authenticated user
             if (user == null) return false;
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	(revision 102)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	(revision 105)
@@ -42,4 +42,5 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -95,5 +96,5 @@
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("read", authUser, store)) {
+            if (!annot.isActionAllowed(Action.read, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;
@@ -116,5 +117,5 @@
         for (Annotation annotation : annotations) {
             // check permission
-            if (!annotation.isActionAllowed("read", authUser, store))
+            if (!annotation.isActionAllowed(Action.read, authUser, store))
                 continue;
             // add annotation to list
@@ -238,5 +239,5 @@
                 return null;
             }
-            if (!storedAnnot.isActionAllowed("update", authUser, store)) {
+            if (!storedAnnot.isActionAllowed(Action.update, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN);
                 return null;
@@ -287,5 +288,5 @@
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("delete", authUser, store)) {
+            if (!annot.isActionAllowed(Action.delete, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	(revision 91)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	(revision 105)
@@ -39,4 +39,5 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -90,5 +91,5 @@
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	(revision 91)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	(revision 105)
@@ -38,4 +38,5 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -79,5 +80,5 @@
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	(revision 102)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	(revision 105)
@@ -57,4 +57,5 @@
 import de.mpiwg.itgroup.annotations.Actor;
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Annotation.FragmentTypes;
 import de.mpiwg.itgroup.annotations.Group;
@@ -680,27 +681,30 @@
          * permissions
          */
-        if (jo.has("permissions")) {
-            JSONObject permissions = jo.getJSONObject("permissions");
-            if (permissions.has("admin")) {
-                JSONArray perms = permissions.getJSONArray("admin");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setAdminPermission(actor);
-            }
-            if (permissions.has("delete")) {
-                JSONArray perms = permissions.getJSONArray("delete");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setDeletePermission(actor);
-            }
-            if (permissions.has("update")) {
-                JSONArray perms = permissions.getJSONArray("update");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setUpdatePermission(actor);
-            }
-            if (permissions.has("read")) {
-                JSONArray perms = permissions.getJSONArray("read");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setReadPermission(actor);
-            }
-        }
+		if (jo.has("permissions")) {
+			// change permissions only if user has admin permission
+			if (annot.isActionAllowed(Action.admin, authUser, getAnnotationStore())) {
+				JSONObject permissions = jo.getJSONObject("permissions");
+				if (permissions.has("admin")) {
+					JSONArray perms = permissions.getJSONArray("admin");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setAdminPermission(actor);
+				}
+				if (permissions.has("delete")) {
+					JSONArray perms = permissions.getJSONArray("delete");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setDeletePermission(actor);
+				}
+				if (permissions.has("update")) {
+					JSONArray perms = permissions.getJSONArray("update");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setUpdatePermission(actor);
+				}
+				if (permissions.has("read")) {
+					JSONArray perms = permissions.getJSONArray("read");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setReadPermission(actor);
+				}
+			}
+		}
 
         /*
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	(revision 91)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	(revision 105)
@@ -36,4 +36,5 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -77,5 +78,5 @@
         for (Annotation annot : annots) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store)) continue;
+            if (!annot.isActionAllowed(Action.read, authUser, store)) continue;
             JSONObject jo = createAnnotatorJson(annot, (authUser == null));
             if (jo != null) {
