ROLE_ADMIN check (generalized)