11/ the admin cannot be an enforcer (self-escalation guard). the enforcer cannot grant new mandates (asymmetric permissions). these are ERC-8226 security requirements, enforced in the constructor.