and at worst, you can do a

BulkCheck

to ask 1. whether the object user is an admin and 2. whether the subject user is a mod and then do your logic in the application