Fix admin policy scoping