1.at least one admin 2.admin can update the email and role of other users, but can't upate role itself