only allow admin users to submit and update bolt/ prefixed