I think if you're making admin_only a default rule, you need to explicitly set lighter permissions for all operations that require it
I think if you're making admin_only a default rule, you need to explicitly set lighter permissions for all operations that require it