admin
approve, reject, and archive incoming submissions
admin access requires an authenticated session with admin role metadata.
