What an Admin can do
The admin area manages Users, bans, roles, Sessions and passwords, and reads the Audit Log. It also manages feature flags and app-update configuration and exposes diagnostics. The platform User role is distinct from an Org role.
Navigation uses the observed Session for presentation. Server operations use adminProcedure or adminWriteProcedure and re-read current authority. A stale sidebar, a demotion or an impersonation cannot preserve old admin permissions.
Audited changes
The admin capability dispatches Better Auth operations inside the existing transaction and audit coordination. Keep those mutations behind that capability instead of writing auth tables directly. Per-User timelines and the global Audit Log expose different authorized views of the same security history.
Impersonation runs with the target User's exact permissions. An admin impersonating a non-admin loses admin access until stopping impersonation. Never recover authority from the impersonatedBy field.
Extend
Add a schema, server operation and localized hook/view. Test unauthenticated access, ordinary Users, a revoked/demoted Admin and impersonation. Destructive actions use the existing dialog patterns rather than window.confirm. Diagnostics must return safe status and never echo credentials.