Client devices probably shouldn’t have admin privileges those should be restricted to the admin UI.

That’s a nightmare waiting to happen when some device pushes an update that deletes your entire library, or a bug in a client does the same.