admin groups are defined in the config