Only Admin should be able to grant admin privileges