Admin endpoints live under /admin, completely separate from /account. An admin middleware on the group requires admin or super role before any request reaches a controller. Per-route policies handle the fine-grained checks on top of that.
Super users bypass all policy checks. Admins go through them and can't touch super users or delete other admins.
See Roles and Permissions for the full policy rules, guard configuration, and seeding.