Added isAdmin policy to prevent unauthorized updates/deletes on objects (fixes #9).