improved access checks for admin and managers