What matters is whether the server authorizes the action.
Removing an admin link from ordinary users’ navigation makes the interface simpler. It does not establish that the underlying page or API rejects an unauthorized request.
Describe the permission
Decide which role can perform the action and which resources it can affect. “Admin” may mean workspace administrator rather than administrator of every workspace.
Verify the boundary safely
Use synthetic users in a verified test environment to compare permitted and denied actions. Check the resource boundary as well as the role: a user with authority in one workspace should not gain that authority elsewhere.
If a tester cannot obtain the necessary accounts or inspect the authorization logic, the report should state that limitation. It should not infer protection from a missing menu item.