Currently every user logged in on admin has the same rights, we have to check ACL / user permissions