Administrators should have `canManage = true`

So they get the group management options