Solved
CQ Annotations Permission
How can we make a group to just do annotations but page cannot be editable? I tried rep:glob but that doesn't work because it restricts instead of making permissions broader. (read all pages, then add write permissions on cq:annotations node)
Thank you in advance.