access check for admin operation