I think this should be good enough. Admins with `*:*` will pass with this check also.