default to allow only Super Admin, let children to override this