work admin class restrictions, use Capabilities API