Simplify permission logic by using the unified `is_admin` flag instead of duplicated role list checks.