“Usually there's at least a regular user role Sometimes there's an admin role and, and if the application is more involved than that, there might be other in-between roles that have, more privileges than a regular user but not quite admin privileges.”

Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 2.