This is used noncoherent throughout the codebase. IMO we should generally only check for `instance.admin`, as global administrators (users in the *Administrator* group) can have (and by default has) the `instance.admin` permission assigned in addition to the `global.admin` permission.