now its correct: group_admin role is needed, nothing else