the admin user always has permissions