restrict getConfirmations to ADMIN, ADMIN_USER