This is smearing code around to distract from what is likely short-sighted IAM data architecture. "Admins are Users except not really" If Admins are really U

This is smearing code around to distract from what is likely short-sighted IAM data architecture. "Admins are Users except not really" If Admins are really Users, then create a User first and then elevate to Admin with ACL assignments, etc. There should probably be accompanying inverse procedures too. If Admins are not really Users (i.e. there is a strong segregation between internal "users" and customer "users"), then avoid coupling their logic at all.